AAFID stands for Autonomous Agents for Intrusion Detection, a distributed intrusion detection system. In this architecture, nodes

Node (computer science)

A node is a record consisting of one or more fields that are links to other nodes, and a data field. The link and data fields are often implemented by pointers or references although it is also quite common for the data to be embedded directly in the node. Nodes are used to build linked, often...

 of the ids are arranged in a hierarchical structure in a tree

Tree (data structure)

In computer science, a tree is a widely-used data structure that emulates a hierarchical tree structure with a set of linked nodes.Mathematically, it is an ordered directed tree, more specifically an arborescence: an acyclic connected graph where each node has zero or more children nodes and at...

. The first generation of Distributed Intrusion Detection Systems had hierarchical architecture.

The general types of distributed intrusion detection systems are as follows:

• hierarchical
• network architecture
  Network architecture
  Network architecture is the design of a communications network. It is a framework for the specification of a network's physical components and their functional organization and configuration, its operational principles and procedures, as well as data formats used in its operation.In...
  
  
• hybrid architecture
• mobile agent
  Mobile agent
  In computer science, a mobile agent is a composition of computer software and data which is able to migrate from one computer to another autonomously and continue its execution on the destination computer.-Definition and overview:...
  
   architecture.
• disturbed .

Agents

Software agent

In computer science, a software agent is a piece of software that acts for a user or other program in a relationship of agency, which derives from the Latin agere : an agreement to act on one's behalf...

in AAFID were not mobile. AAFID was one of the earliest hierarchical distributed intrusion detection systems.