An effective system inspired from honeybees protection mechanism in nature is proposed to detect and prevent network attacks. The proposed approach consists of multi-agents deployed in distributed locations in the network to discriminate normal from malicious activates. These agents recognize a network attack using a mechanism contains Undesirable-Absent (UA) or Desirable-Present (DP) methods. The mechanism of recognizing the attacks is achieved through monitoring, detection and decision stages of protection. The UA method is used in the monitoring stage for matching the normal behavior based on absence of attacks’ signatures.