Abstract: In the study of the intrusion detection, the SVM based active learning algorithm can reduce the sample complexity.Aiming to improve the inferior quality of initial training set resulted from random construction and avoid the propensity to suboptimum in SVM based active learning algorithm, a modified algorithm was proposed.It both incorporates the algorithm of constructing initial training set with kernel-based clustering and the scheme of probabilistic query based on the distance criteria.The experiment result shows that the proposed algorithm needs less samples and is more stable under the same detection performance condition.