Patent ID: 7814548

Claim:
A computer implemented instance-based learning method for detecting intruders into a computer comprising: capturing historical data input into the computer by a user during a training mode; profiling the historical data during the training mode by converting streams of shell command traces into fixed length instances; profiling the fixed length instances to identify normal behavior using a single data structure and a clustering algorithm with respect to the data structure, the data structure comprising a list of tables, the tables among said list of tables having a size that is limited by an upper bound; determining a representative instance; comparing the representative instance to the fixed length instances utilizing the clustering algorithm in order to create clusters that are mapped to the tables among said list of tables; capturing test data input by the user into the computer during an operational mode; comparing the test data with the profiled historical data in accordance with a predetermined similarity metric during the operational mode to identify test data that falls outside of previously identified clusters, selecting dynamically a set of representative instances, wherein each of the representative instances represents a corresponding one of the clusters, calculating similarity scores between query instances and each of the representative instances, using the similarity metric, producing a real, non-negative root for each similarity score within a predefined interval, using each root, determining the representation in the list of tables of each respective query instance displaying a notification upon identifying the test data falling outside previously identified clusters.