Abstract: In order to choose the better anomalous detection model based on the training data in intrusion detection system（IDS），this paper uses the relative entropy density divergence as a measure of the models.Through analyzing the difference between the model’s distribution and the training data’s real distribution，using few data to find the better suitable detection model based on the dependence of the original data.The experimental results show that the HMM is better than the MCM in view of the given data.