Abstract: A method of database intrusion detection based on adaptive model is proposed. First, the conception of mini-support function and attribute distance are defined. Then, a new association algorithm based on defined conception is proposed to extract operating characteristics in time window. The value of mini-support function can be dynamically adjusted, so operating characteristics could be extracted more efficiently. Furthermore, hierarchical clustering algorithm is applied to produce dynamic clustering rule base. The intrusion could be judged by computing the distance between operating characteristics and cluster in rule base. In this way, the problem of judging 'sharp boundary’ in current database intrusion detection system could be avoided. In the progress of intrusion detection, characteristics of normal operation are absorbed by rule base, and rule base is updated in time. The experimental results show that the intrusion be detected has a high correct rate and a low false rate.