Abstract: The process of network attack detection not only needs to keep the accuracy of classification, but also reduces time consuming. On the basis of the traditional data stream mining methods, an improved incremental learning model is proposed. The proposed model builds a cycle structure with multi-models, and finds the support vectors in geometry direction. The model uses central distance ratio methods to obtain the best support vectors and then retrain Support Vector Machine（SVM） model. In experiment, the UCI dataset is employed and the model is compared with two other classification model. The experimental result proves the model has better classification performance.

Key words: incremental learning, Support Vector Machine（SVM）, data stream, abnormal detection, multi-model

摘要： 针对网络数据流异常检测，既要保证分类准确率，又要提高检测速度的问题，在原有数据流挖掘技术的基础上提出一种改进的增量式学习算法。算法中建立多模型轮转结构，在每次训练中从几何角度出发求出当前训练样本集的支持向量，选择出分布于超平面间隔中的支持向量进行增量SVM训练。使用UCI标准数据库中的数据进行实验，并且与另外两种经典分类模型进行比较，结果表明了方法的有效性。

关键词: 增量式学习, 支持向量机, 数据流, 异常检测, 多模型