We proposed a modified version of optimum-path forest (MOPF) for intrusion detection.
Social network analysis is used for pruning the training set to speed up the OPF.
A partitioning module is used to improve the detection rate of low-frequent attacks.
The classification phase of traditional OPF is modified for improving the accuracy.
Our method improved detection/false alarm rate and execution time of traditional OPF.