In this paper, we adopts two steps for the intrusion detection framework for online education: initialization and online detection. The architecture of the intrusion detection framework is illustrated in Figure 1.
The framework of online network intrusion detection
In the stage of initialization, the intrusion detection system mainly construct an intrusion detection knowledge library which consists of previous knowledge of intrusions. The obtained data in the network stream are clustered as several parts as pseudo-classes. The pseudo-classes are denoted by domain experts. Then, the denoted data are added into knowledge library.