With the development of the Internet .this article introduces a method of time window,that can be used to collect as much legit data as possible via creating new time windows,inserting data into the time windows and destroying time windows. The number of time windows maintained depends on practical applications. The new coming data will be inserted into existing time windows according to its timestamp and source mark. If fail to insert,we then destroy some of the time windows and creatie new time windows to hold the new comers.