The invention relates to a network intrusion detection method based on data mining. In the prior art, problems that the classification accuracy is reduced due to the defect of sample weight updating,the classification speed is low due to a redundant weak classifier, and the calculation cost is high exist. According to the method, in the weak classifier training stage, the Adaboost algorithm of the improved weight updating method is adopted for weak classifier training, the sample weights are updated according to the weighted average accuracy of all samples in previous t times of training, infinite expansion of the noise sample weights is restrained, and weight updating of all the samples is more balanced. In a weak classifier combination stage, a new mode for measuring the similarity between weak classifiers is provided; selective integration is performed based on the similarity measurement mode and the hierarchical clustering algorithm, weak classifiers with the similarity exceedinga threshold value are classified into one class, the weak classifier with the highest classification accuracy in each class is selected to be combined into a strong classifier, and therefore redundantweak classifiers are removed, the classification speed is increased, and calculation expenditure is reduced.