关键词: 增量式学习, 支持向量机, 数据流, 异常检测, 多模型

Abstract: The process of network attack detection not only needs to keep the accuracy of classification, but also reduces time consuming. On the basis of the traditional data stream mining methods, an improved incremental learning model is proposed. The proposed model builds a cycle structure with multi-models, and finds the support vectors in geometry direction. The model uses central distance ratio methods to obtain the best support vectors and then retrain Support Vector Machine（SVM） model. In experiment, the UCI dataset is employed and the model is compared with two other classification model. The experimental result proves the model has better classification performance.

Key words: incremental learning, Support Vector Machine（SVM）, data stream, abnormal detection, multi-model