Patent Document ID: 20100107255
Application ID: 12398432
Patent Flag: 0

Claim One:
1. An intrusion masquerade detection method comprising: a computer applying a compression algorithm to user data to build user grammars associated with a user; forming at least one model by storing said user grammars using a database; applying said compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic; searching a string of data from said target block for phrases matching user grammars contained in said at least one model; sorting the user grammars so that longest phrases among said user grammars are applied first to an unclassified string; converting each matching phrase to a variable-length code value by replacing each said matching phrase with a corresponding variable-length code value; attributing a cost for phrases that are not found in the at least one model by quantifying the cost of explicitly representing symbols associated with those phrases; determining a degree of fit between said target block and said at least one model based on said cost; and detecting an intrusion masquerade based on said degree of fit.