Patent ID: 8312542

Claim:
A network intrusion detection method, comprising: receiving a sequence of input data; separating the received sequence of input data into a plurality of input data portions; associating each of the plurality of input data portions with one of a plurality of authorized users; aggregating a number of the input data portions associated with one of the plurality of authorized users into a data set; compressing the data set using a compression algorithm to produce a compressed data set; forming at least one compression model, each said the at least one compression model comprising a plurality of the compressed data sets; comparing each subsequent compressed data set associated with a subsequently received data set to each of the compressed data sets of the at least one compression model; calculating a distance value for each comparison; detecting an intrusion event, by a computer, based on one or more calculated distance values; and outputting an intrusion detection decision, the intrusion detection decision comprising an alarm indication if an intrusion event is detected, wherein the detecting includes: estimating a randomness deficiency for a received data set by applying the compression algorithm, each of the distance values being a distance metric associated with the estimated randomness deficiency; normalizing the estimated randomness deficiency based on a size of the received data set; and determining an intrusion event based on a difference between the normalized estimated randomness deficiency for the received data set and an expected compression contained in the at least one compression model.