Abstract: With the growth of the network complexity, the traditional intrusion detection methods have been unable to meet the high-level security requirements. How to use data mining algorithm to improve accuracy rate of intrusion detection is a hot spot in current research. For this purpose, a hybrid intrusion detection algorithm based on k-means and decision tree algorithm (KDI) is proposed. Firstly, an improvement on data discretization method is advanced, in order to obtain high quality sample data, and then the k-mean algorithm is utilized to classify the sample data based on the feature of slight difference between information divergence ratio in many real situations, subsequently, the decision trees is constructed, therefore, the detection rate is enhanced. The experimental results show that the KDI algorithm can effectively detect both known and unknown intrusion behaviors sealed in network data.

Key words: k-means, decision tree, intrusion detection, data discretization