Abstract: In order to improve the detection rate of anomaly detection system,reduce the false alarm rate,and solve the problems existing in the current anomaly detection,outlier mining techniques were applied to anomaly detection,and this paper presented a network anomaly detection method based on hybrid clustering algorithm (NADHC).In the method,the clustering algorithm based on distance is combined with the density clustering algorithm to form a new hybrid clustering algorithm.The method is based on the k-medoids algorithm to find out the cluster centers.Next,NADHC removes a small amount of attack behavior samples which has obvious characteristics of high concealment,then calculates the abnormal degree by the repeated increasing samples combined with density-based clustering method to determine the abnormal behavior.NADHC algorithm was validated on KDD CUP 99 dataset.The experimental results show its feasibility and effectiveness.

Key words: Anomaly detection,Outlier mining,NADHC