Abstract: A novel approach to learn and identify the anomalous behaviors in network was proposed.Unlike previous work,the intrusion detection problem is mapped into the topic model and a classifier is built.Two kinds of connections,namely normal and anomalous ones,are separated before training the model according to the labels of the connections.By analyzing the effect of the parameters,it shows that α (Dirichlet parameter of topics) and the number of topics have positive correlation with the results of prediction,while β (Dirichlet parameter of feature numbers) has negative correlation with the results of prediction.This model was evaluated using KDDCUP’99 dataset.The result suggests that the prediction accuracy is up to 91.69% which outperforms SVM algorithm in normal and anomalous behaviors classification.

Key words: Topic model,Anomalous behavior,Classifier