Traditional intrusion detection methods lack extensibility in face of changing network configurations as well as adaptability in face of unknown attack types.

• 现代网络中用户的行为以及网络结构不断发生变化,因而需要大量已标记的样本数据,用以动态更新入侵检测模式。