the growing number of network attacks has become a serious threat for computers and networks worldwide. Conventional intrusion detection techniques are ineffective inmost complex, and specially distributed attacks. In this paper a new approach to build a global model in distributed intrusiondetection , while managing bandwidth limitations has been proposed . in the proposed scheme local attacks are determined using data mining techniques such as clustering methods and outlier detection techniques.