Network attack detection has always been a hot and difficult point in the field of network security research. The direct network anomaly detection algorithm is an algorithm for network detection based on the Euclidean distance measurement. The Euclidean distance algorithm has a large amount of data calculation

and the calculation process does not consider the difference in the importance of different detection sample data. In order to solve this problem

this paper proposes the use of Mahalanobis distance instead of Euclidean distance

and then proposes a network anomaly detection model based on Mahalanobis distance. The KDD Cup 1999 data set was tested and compared with the original algorithm. The results show that the training samples of this detection model take a short time

have a high detection rate and a low false alarm rate.