1. An apparatus for identifying at least a similarity between at least a portion of a command submitted for execution comprising a plurality of tokens, and at least one of a first set of a plurality of acceptable commands comprising tokens, the apparatus comprising: a user session storage having an input/output for receiving at the user session storage input/output storing and providing at the user session storage input/output a plurality of identifiers comprising tokens corresponding to the command submitted for execution and previously identified as at least similar to at least one of a second set of a plurality of acceptable command; and a token compare having a first input operatively coupled to receive at least a portion of the command submitted for execution, a second input coupled to the user session storage input/output for receiving at least one of the identifiers and an output having a first state responsive to at least one of the at least one tokens received at the token compare second input at least substantially similar to at least one of the tokens of the command submitted for execution received at the token compare first input.