Aimed at the problems that malwares like Trojan horses are performing more and more harmfully to the network security,to improve the efficiency of Trojan horse detection by NIDS,the characteristics and network communication forms of Trojan horses are analyzed.Then combined a sequence alignment algorithm,a model for signatures automatic generation of Trojan horses is designed and implemented.Finally,this model is proved to be practical and effective by the experiments.