An　incremental　intrusion　detecting　model　is　proposed　in　this　paper.　This　model　integrates　unsupervised　Self　Organizing　Map　and　supervised　Radial　Basis　Function　to　complete　incremental　learning.　Self　Organizing　Map　can　get　new　type　intrusion　information　and　generate　new　nodes　in　Radial　Basis　Function.　By　this　model,　intrusion　of　unknown　type　can　be　detected　online.　Experiment　results　show　our　model　could　detect　new　type　intrusions　without　forgetting　the　old　ones.　©　2010　IEEE.