Abstract: In this paper, the normal cloud model for network intrusion detection, and a normal cloud model is based on the network intrusion detection algorithms, to take the first feature extraction algorithm and calculate the impact of weight factor, the introduction of cloud computing attributes generators and difference eigenvalue, the value of comprehensive evaluation of the application to judge the invasion, resulted in a reduction of a single attribute of the local impact.The experimental results show that this method can detect more effective network data in real unknown intrusions, to a certain extent to solve some of the current intrusion detection algorithms detect the existence of the low rate of high false alarm rate.