Patent Document ID: 20100107254
Application ID: 12260682
Patent Status: 0

Claim One:
1. A network intrusion detection method comprising: receiving a sequence of input data; separating said received input data sequence into a plurality of input data portions; associating each said input data portion with one of a plurality of authorized users; aggregating a number of said input data portions associated with one said authorized user into a data set; compressing said data set using a compression algorithm to produce a compressed data set; forming at least one compression model, each said compression model comprising a plurality of said compressed data sets; comparing each subsequent compressed data set associated with a subsequently received data set to each said compressed data set of said at least one compression model; calculating a distance value for each said comparison; detecting an intrusion event based on one or more of said calculated distance values; and outputting an intrusion detection decision, said intrusion detection decision comprising an alarm indication if an intrusion event is detected.