1. A computer implemented method of intrusion detection in an enterprise network, the method comprising: a) developing a prediction model to predict expected values of future anomaly scores from real time anomaly scores based on an output of an anomaly detection system derived from an input of network traffic pattern data of the enterprise network in real time under benign conditions; b) setting an adaptive classification threshold based on the expected values predicted by the prediction model; and c) classifying unknown observations not within the adaptive classification threshold as possible intrusions; wherein the expected values of future anomaly scores ({circumflex over (r)} (n+1) ) are calculated from the equation: r ^ ( n + 1 ) = max j = 1 , … , k ⁢ p j | r ( n ) ( n + 1 ) , ⁢ where p j | r ( n ) ( n + 1 ) = p ~ j | r ( n ) ( n + 1 ) ∑ i = 1 k ⁢ p ~ i | r ( n ) ( n + 1 ) , ∀ j = 1 , … ⁢ , k , ⁢ where p ~ r ( n ) ± i | r ( n ) ( n + 1 ) = ɛ ( n ) × p r ( n ) ± i | r ( n ) ( m ) , ∀ i = 1 , … ⁢ , β , ⁢ where ɛ ( n ) =  r ( n ) - r ^ ( n )  , where p (n) is a kXk transition probability matrix of a Markov chain predictor at time n and r (n) is the real time anomaly score at time n.