Abstract: A system and method for detecting an intrusion on a network is described herein. The system comprises a processor 201 and memory 203. The processor 201 may sniff and analyse a header data of each packet and further create a plurality of network events on the basis of a content of each packet. The processor 201 may identify a pattern of the plurality of network events in the network data flow using a knowledge based finite state machine. The identified pattern is then fed into an Incremental Probability Action Modelling (IPAM) engine to predict a next state in the identified pattern based on a probability of network events. The processor 201 may prepare a probability grid with the probability of the next state as a warning state. The processor 201 may generate, one or more alerts of the intrusion detection on the basis of prediction of the warning state.