An unsupervised clustering-based intrusion detection algorithm is discussed.The basic idea of the algorithm is to produce the cluster by comparing the distances of unlabeled training data sets.With the classified data instances

anomaly data clusters can be easily identified by normal cluster ratio.And then the identified cluster can be used in real data detection.The benefit of the algorithm is that it needn't labeled training data sets.Using the data sets of KDD99

the experiment result shows that this approach can detect unknown intrusions efficiently in the real network connections.