There are some issues for the shuffle network intrusion detection, such as high loss detection rates and time-consuming procedures. This paper proposes a shuffle network intrusion detection method fusing the misuse behavior analysis and analyzes the network misuse behavior procedures. According to the damaged data flow balance features by network misuse behavior, the paper applies the hypothesis test in probability theory to evaluate whether the confidence interval excesses 0. If the confidence interval does not contain zero, it indicates the presence of feed-forward network intrusion; otherwise, there is no feed-forward network intrusion. The experimental results show that this method can effectively solve the multi-packet collaborative intrusion problems. Compared to traditional methods, the test speed and accuracy of the method is significantly improved.
