Abstract: This paper proposed the improvement k-means algorithm, join filter optimization function through the cluster set the number of candidates clusters, deleted the optimal cluster the data in the data set, the optimal cluster, improve production later network database intrusion detection, reduce the efficiency of the miss rate.The experiment results show that the method can optimize the clustering to create the number of clusters, for the number of network data quantity intrusion detection provides convenience, improve the detection accuracy, and to reduce the miss rate.