1. A computer implemented method for adaptive anomaly-based intrusion detection, the method comprising: a) developing a prediction model of expected values of future anomaly scores under benign conditions; b) using the prediction model to set an adaptive classification threshold as a function of the predicted score; c) using the adaptive threshold to classify unknown observations as possible intrusions.