Most papers on detection intrusion problems made by past researchers usually employ rule portfolio to match attack data packages and appear unable to keep the system in optimized detection status when the detection probability is unknown or varying. In this paper, the method of rule set election is improved and the optimal solution via establishing convex relaxation function is gained, then attack package is matched with it. Finally simulation is done with computer, which shows that the effect is better than that of the BM method.