The open nature of public network and the characteristics of self - organization cause the network to be vulnerable to virus interference and intrusion attacks. The traditional method uses the time-frequency directional beam characteristic clustering method to realize the attack data mining, and the low probability of attack data mining is low when the SNR is low. A common network attack data mining algorithm based on adaptive filtering detection and time frequency feature extraction is proposed. First public network attack data signal fitting and time series analysis, detection adaptive filtering noise attack data to fit the signal and improve the purity of the signal, the filter output data time-frequency feature extraction, to achieve accurate attack data mining. The simulation results show that the proposed algorithm is used for data mining in network attack, which has high performance on the feature of attack data, and has a strong restraining performance against interference.