  As the communication industry has connected distant corners of the globe
using advances in network technology, intruders or attackers have also
increased attacks on networking infrastructure commensurately. System
administrators can attempt to prevent such attacks using intrusion detection
tools and systems. There are many commercially available signature-based
Intrusion Detection Systems (IDSs). However, most IDSs lack the capability to
detect novel or previously unknown attacks. A special type of IDSs, called
Anomaly Detection Systems, develop models based on normal system or network
behavior, with the goal of detecting both known and unknown attacks. Anomaly
detection systems face many problems including high rate of false alarm,
ability to work in online mode, and scalability. This paper presents a
selective survey of incremental approaches for detecting anomaly in normal
system or network traffic. The technological trends, open problems, and
challenges over anomaly detection using incremental approach are also
discussed.
