Systems and methods for network-based intrusion detection are provided. An anti-adversarial Hidden Markov Model can be used to effectively detect evasion patterns for network-based intrusion detection, using dynamic window and threshold techniques to achieve adaptive, anti-adversarial, and online learning abilities. The concepts of pattern entropy, pattern entropy reduction, window width, local optimal window width, and dynamic window can be used in the model.