A method of detecting network intrusion based on improved support vector machine is disclosed. The single-pass process provides high conversion concentration while operating at relatively low feed flow rates, and the process can also be used to provide constant output diafiltration. The cyan dye set includes direct blue 199 dye, acid blue 9 dye, and direct blue 86 dye.