To meet network security requirement, the model of SISH (Study of Intrusion Signature based on Honeypot) takes advantage of honeypot technology to collect the activities of attackers on the honeypot. According to information replied from the honeypot, and data captured on the network, one can reproduce the attack with attack tree. Having classified the attack information of the attacked objects, one can create the signature of the intrusion data in the same class by LCS(Longest Common Sub-string) algorithm. new signatures are used to enrich the signature database of the IDS to make up for the deficiency of the IDSs and perfect defense system.