Abstract: In this paper, we propose a method using clustering algorithm to detect intrusion attacks. Detecting precision is improved by taking domain knowledge and numerical value quality into account. Through a series of experiments, our algorithm is proved to be efficient.