Our paper focuses on the limitation faced in the traditional approaches. In this paper a hybrid framework based on associated clusters and random ant colony optimization (R-ACO). In our approach the dataset of NSL-KDD have been considered. It is a data set which does not include redundant record and test sets. Then equal proportion dataset from the whole dataset are selected. The data is pre-processed according to the normal data filtration and attack data filtration. Then normal data based on the intrusion filed is pre- processed which are not received as the normal set. This dataset is passed for k1-k6 transaction for finding the associated cluster based on the property. Then R-ACO for finding the global optimum value has been applied. If the optimum value satisfied the threshold, then the node will be added into the final attack category. Finally based on the attack category of Denial of Service (DoS), User to Root (U2R), Remote to User (R2L) and Probing (Probe) based on the final classification. Our results support better classification in comparison to the previous techniques used in several research papers as per our study.