Abstract: A detecting method over network intrusion comprises: selecting a plurality of features contained within plural statistical data by a data-transforming module; normalizing a plurality of feature values of the selected features into the same scale to obtain a plurality of normalized feature data; creating at least one feature model by a data clustering technique incorporated with density-based and grid-based algorithms through a model-creating module; evaluating the at least one feature model through a model-identifying module to select a detecting model; and detecting whether a new packet datum belongs to an intrusion instance or not by a detecting module.

Abstract: A method for grid-based data clustering comprises: creating a feature space having a plurality of cubes by a computer and showing the feature space by an interface of the computer, disposing a plurality of data stored in a database into the cubes, and then defining a plurality of the cubes as populated cubes; identifying whether the data within each of the populated cubes being evenly distributed or not to define each populated cube as a major cube or minor cube; combining border data of the minor cubes with the data in the major cubes; and designating all the data combined with each other as in the same cluster and recursively processing the above procedures to cluster all the data stored in the database.