Intrusion detection has gain a broad attention and become a fertile field for several researches, and still being the subject of widespread interest by researchers. The intrusion detection community still confronts difficult problems even after many years of research. Reducing the large number of false alerts during the process of detecting unknown attack patterns remains unresolved problem. However, several research results recently have shown that there are potential solutions to this problem. Anomaly detection is a key issue of intrusion detection in which perturbations of normal behavior indicates a presence of intended or unintended induced attacks, faults, defects and others. This paper presents an overview of research directions for applying supervised and unsupervised methods for managing the problem of anomaly detection. The references cited will cover the major theoretical issues, guiding the researcher in interesting research directions.

Intrusion detection continues to be an active research field. Even after 20 years of research, the intrusion detection community still faces several difficult problems. Detecting unknown patterns of attack without generating too many false alerts remains an unresolved problem. Although recently, several results have shown that there is a potential resolution to this problem. Anomaly detection is a key element of intrusion detection in which perturbations of normal behavior suggest the presence of intentionally or unintentionally induced attacks, faults, and defects. This paper proposes a hybrid machine learning model based on combining the unsupervised and supervised classification techniques. Clustering approach based on combining the K-means , fuzzy C-means and GSA algorithms to obtain the normal patterns of a user's activity, the technique is used as the first component for pre-classification to improve attack detection. Then, a hybrid classification approach of Support Vector Machine (SVM) and Gravitational Search Algorithm (GSA) algorithm will be used to enhance the detection accuracy.this research used the KDD CUP 1999 to get initial results, which were encouraging.