Intrusion Detection System (IDS) is intended to detect anomalous usages or attacks on system and network. Even though many IDS models have been developed, they still may have problems, such as involvement of components contaminated by anomalous process, in detecting anomalous behavior patterns. To distinguish anomalous patterns from normal patterns, we propose a Bayesian approach which includes the presentation of the relations among normal pattern components.