(FP). Anomaly detection model identifies new attacks by analyzing the anomalous behaviors from normal behaviors [9], and achieves high detection rates (DR) for new attacks, but produces many false positives (FP). Anomaly based IDS generate rules by observing collected audit data that is the records of activities generated by the operating system. Currently adaptive intrusion detection aims to solve the problems of analyzing the huge volumes of audit data and realizing performance optimization of detection rules [10]-[14]. Detecting intrusions using data mining algorithms such as decision tree (DT), naïve Bayesian 
(NB) [15], neural network (NN), support vector machine (SVM) [16], k-nearest neighbors 
(KNN), fuzzy logic model [17], and genetic algorithm [18] have been widely used in the last decades. However, there exist various problems in current IDS such as low detection accuracy, unbalanced detection rates for different types of attacks, high false positives, redundancy of input attributes as well as examples in the training data. Another difficulty of current IDS is to detect intrusions in real time high-speed networks, because the high-speed networks require IDS 
to deal with large volumes of network data in a very short time. In this paper, based on a comprehensive analysis for the current research challenges in intrusion detection, a new learning algorithm for adaptive network intrusion detection using naive Bayesian classifier and decision tree is presented, which can handle the above mentioned challenging issues. This paper also addresses some difficulties of data mining such as handling continuous attribute, dealing with missing attribute values, and reducing noise in training data. The experimental results by using KDD99 benchmark intrusion detection dataset prove that the proposed algorithm has achieved both high detection rates (DR) and the significant reduction of false positives (FP) in comparison with existing methods. 

The remainders of the paper are organized as follows. Section 2 presents the related overview of networking and intrusion detection. The basic problems of learning are discussed in Section 3, whereas our proposed algorithm is introduced in Section 4. Then, the experimental results are expressed in Section 5. Finally, our conclusions and future works are mentioned in Section 6. 

## 2. Networking And Intrusion Detection O**Verview** 2.1. Networking Overview

In the networks, TCP/IP is widely used for network communications, which are composed of four layers: application layer, transport layer, network layer, and hardware layer that work together [19]. When data transfers across the networks, the data passes from the highest layer through intermediate layers to the lowest layer. The lowest layer sends the accumulated data to its destination through the physical network. Application layer sends and receives data for particular applications, such as DNS, HTTP, FTP, SMTP, and SNMP. It enables applications to transfer data between server and client, and passes application data to the transport layer. Transport layer is responsible for packaging data using TCP (Transmission control protocol) and UDP (user datagram protocol) so that it can be transmitted between hosts. Each TCP or UDP packet has a source port and a destination port number. Network layer or internet protocol (IP) layer is in charge of handling the addressing and routing of data received from the transport layer. After the network layer has encapsulated the transport layer data, the resulting logical units are referred to as packets. Each packet contains a header, which is composed of various fields. Commonly used network layer protocols are IPv4, IPv6, ICMP (internet control message protocol), and IGMP (internet group management protocol). It is also responsible for providing error and status information involving the addressing and routing of data. Hardware layer or data link layer tackles communications on the physical network components including cables, routers, switches, and network interface cards (NIC). The best known hardware layer protocol is Ethernet. Ethernet relies on the concept of a media access control (MAC) address, which is a unique six-byte value (such as 00-02-B4-DA-92-2C) permanently assigned to a particular NIC. 