The invention relates to a Snort improvement method based on a data mining algorithm. The method comprises the following steps that: acquiring, by an intrusion detection Snort system, data P on a network; carrying out similarity clustering on the P and a normal behavior database by utilizing an improved K-means algorithm, if the similarity is smaller than a clustering radius r, judging the P and the normal behavior database as normal data, and directly skipping a misuse detection process of Snort; otherwise, comparing the data with the abnormal database in the Snort again, calculating the similarity between the data and each abnormal behavior class, if the data can be clustered in the abnormal behavior classes, indicating that the data is of an abnormal data type, and sending out a corresponding alarm by the system; and if the abnormal class still cannot be clustered, adding the abnormal class to the normal database, and updating the normal behavior database again. Most of the data onthe network is normal data, the abnormal data only occupies a small part, the clustering accuracy of the improved K-means algorithm is high, and the data processed by misuse of a detection engine canbe greatly reduced through the above mode, so that the overall detection accuracy and efficiency of the Snort system are improved.