Abstract: In order to choose the better anomalous detection model based on the training data in intrusion detection system（IDS），this paper uses the relative entropy density divergence as a measure of the models.Through analyzing the difference between the model’s distribution and the training data’s real distribution，using few data to find the better suitable detection model based on the dependence of the original data.The experimental results show that the HMM is better than the MCM in view of the given data.

摘要： 针对入侵检测系统（IDS）中基于训练数据选择较好的异常检测模型。使用相对熵密度偏差作为模型之间的度量。通过分析模型的分布与训练数据真实分布的差异，根据原数据本身的相依关系，使用较少的数据选择出较好的适用检测模型。实验结果证明针对所给的数据，隐马氏模型（HMM）要好于马氏链模型（MCM）。