Abstract: An intrusion detection mechanism was proposed for mobile agent to meet the security requirements in accordance to the hierarchical characteristics of Ad Hoc networks. In this mechanism, a typical behavior model of nodes is developed by analyzing the node's ability to deal with the messages in routing process. The cluster-head agent is used to monitor and collect the behavior information of all the members in the cluster. Then, the collected information is matched with the typical behavior model to estimate the abnormal behavior of the node, thus locating the attacking node by virtue of fuzzy method so as to take responding measures to restrict the harm of malicious nodes which are attacking the network. Simulation results showed that the intrusion detection mechanism proposed can detect the abnormalities in time and accurately in hierarchical Ad Hoc networks.