1. An intrusion masquerade detection method comprising: applying a compression algorithm to user data to build user grammars; forming at least one model using characteristics of the user grammars, said characteristics including an estimated algorithmic minimum sufficient statistic; storing said model using a database; calculating said estimated algorithmic minimum sufficient statistic by applying said compression algorithm to at least one target block; determining a distance between said at least one target block and said model; determining an intrusion masquerade based on said distance; and outputting an indication of an intrusion masquerade.