The　paper　proposes　a　IDS　that　is　based　on　HGA　and　Data　mining.　In　this　model,　an　improved　clustering　algorithm　is　introduced　to　classify　the　normal/abnormal　behaviour　library　from　behaviour　records　on　the　network　and　in　the　system.　Then　it　takes　the　HGA　and　data　mining　as　a　basis　to　dig　out　the　the　invasion　rules　and　put　them　into　the　rule　base.　Finally,　Hybrid　Detection　Module　is　proposed　to　detect　the　intrusion　system.　The　experiment　shows　that　with　a　high　adaptability,　the　model　has　enabled　to　detect　unknown　intrusion,　improve　the　detection　rate　and　reduce　the　false　detection　rate,　thus　to　protect　the　computer　systems　from　exotic　intrusion.　©　2017　AMSE　Press.　All　rights　reserved.