1. A method of detecting intrusions in a computer network, including the steps of: using a feature ranking algorithm to extract features of interest from a network and network activity; using a kernel-based algorithm to analyze such features to determine if they are normal or malicious; and if malicious, causing said activity to be denied prior to access, terminated after access, limited in scope, honey-potted or tracked.