On the basis of a deep research and analysis of the Apriori algorithm in association rule mining，some shortages of the algorithm are discovered. The strategy of the join step,the prune step and the method of dealing with the transaction database is improved, which improves the efficiency of the Apriori algorithm both in time and space. An intrusion detection method based on the improved algorithm is proposed. The rule library of the system can be updated automatically. The security and the dependability of the system can be greatly improved. The experimental results of the improved algorithm show that the method improves the production efficiency of frequent item sets and the knowledge rule library.