Data mining-based network intrusion detection method

The invention discloses a data mining-based network intrusion detection method, relating to a network intrusion detection method. The existing real-time intrusion detection method cannot detect network intrusion behaviors with characteristics changed in real time. The invention solves the above problem. According to the method, a known network intrusion type is analyzed at first, a program activity cycle is extracted, a characteristic corresponding to the known network intrusion type is acquired and a network intrusion type model is trained; network intrusion is simulated, and a host of an ELKlog analysis platform is deployed so as to monitor all log files; and finally, network intrusion is monitored in real time based on the network intrusion type model, and the ELK log analysis platformdetects changed log files and abnormal data in the log files and updates major detected objects, so as to complete the network intrusion type model. The data mining-based network intrusion detectionmethod is applicable to det