A new method for detecting intrusions was developed using a neural network. The method transforms features to better separate normal and attack samples, improving clustering effectiveness. By using a hidden layer in the neural network, a transformation function is obtained to reflect the domain's characteristics. Experiments on network connection records showed that this method performs exceptionally well in distinguishing between normal and attack samples.