1. A network intrusion detection system comprising: a processor coupled to a nontransitory computer readable medium bearing software instructions that, when executed by the processor, cause the processor to perform operations including: clustering raw network traffic files into a plurality of natural clusters based on minimum description length (MDL) similarity; building an MDL model for each natural cluster; calculating distances from each traffic file to each MDL model to obtain a distance vector for each traffic file, each distance vector having a distance from a corresponding traffic file to each MDL model; clustering labeled network traffic data into a plurality of trained clusters; selecting features of the plurality of natural clusters and the plurality of trained clusters for use in classification of network traffic; building a decision model based on the distance vectors and the selected features of the plurality of natural clusters and the plurality of trained clusters; analyzing network traffic using the decision model; generating an output based on the analyzing, the output indicating potential matches between network traffic and an MDL model corresponding to malicious activity; and displaying on a display, a visualization plot based on the output, the plot showing a graphical representation of network traffic distance from the plurality of natural clusters.