Intrusion detection system(IDS) has recently emerged as an important component for enhancing information system security. Intrusion detection technology is an effective approach to dealing with the problems of network security. In this paper, we present a data mining-based network intrusion detection framework in real time (NIDS). This framework is a distributed architecture consisting of sensor, data preprocessor, extractors of features and detectors. To improve efficiency, our approach adopts a novel FP-tree structure and FP-growth mining method to extract features based on FP-tree without candidate generation. FP-growth is just accord with the system of real- time and updating data frequently as NIDS. We employ DARPA intrusion detection evaluation data set to train and test the feasibility of our proposed method. Experimental results show that the performance is efficient and satisfactory. Finally, the development trend of intrusion detection technology and its currently existing problems are briefly concluded.