1. A method of detecting intrusion comprising the steps of: a) identifying a plurality of features; b) computing information gain of each of said plurality of features; c) selecting a pre-determined number of features from said plurality of features based on said information gain and augmenting said pre-determined number of features with special features to form a set of selected features; and d) classifying a network connection based on said set of selected features using support vector machine; wherein said plurality of features are selected from a group of features consisting of basic features of a TCP connection, content features within a connection suggested by a domain knowledge and traffic features computed using a two-second time window.