16. A non-transitory computer-readable medium upon which is embodied a sequence of programmable instructions which, when executed by a processor, cause the processor to perform an intrusion masquerade detection method comprising: applying a compression algorithm to one or more sets of user input content data to build a set of user grammars; forming at least one model for the set of user grammars using characteristics of the set of user grammars, the characteristics including a first estimated algorithmic minimum sufficient statistic for the set of user grammars; storing the at least one model for the set of user grammars in a database; calculating a second estimated algorithmic minimum sufficient statistic for at least one target block of other input content data by applying the compression algorithm to the at least one target block of the other input content data; determining a distance between the at least one target block of the other input content data and the at least model for the set of user grammars by comparing the first estimated algorithmic minimum sufficient statistic and the second estimated algorithmic minimum sufficient statistic; determining an intrusion masquerade based on the determined distance; and outputting an indication of the determined intrusion masquerade.
16. A non-transitory computer-readable medium upon which is embodied a sequence of programmable instructions which, when executed by a processor, cause the processor to perform an intrusion masquerade detection method comprising: applying a compression algorithm to one or more sets of user input content data to build a set of user grammars; forming at least one model for the set of user grammars using characteristics of the set of user grammars, the characteristics including a first estimated algorithmic minimum sufficient statistic for the set of user grammars; storing the at least one model for the set of user grammars in a database; calculating a second estimated algorithmic minimum sufficient statistic for at least one target block of other input content data by applying the compression algorithm to the at least one target block of the other input content data; determining a distance between the at least one target block of the other input content data and the at least model for the set of user grammars by comparing the first estimated algorithmic minimum sufficient statistic and the second estimated algorithmic minimum sufficient statistic; determining an intrusion masquerade based on the determined distance; and outputting an indication of the determined intrusion masquerade. 18. The non-transitory computer-readable medium of claim 16 , the calculating the second estimated algorithmic minimum sufficient statistic by applying the compression algorithm to at least one target block of the other input content data, further comprising: searching, in real-time, a string of the other input content data for MDL compression phrases from the at least one model for the set of user grammars; substituting with Huffman code for found phrases; sorting the set of user grammars so that longest phrases are applied first to an unclassified string of the other input content data and attributing a cost for phrases that are not found in the at least one model for the set of user grammars by quantifying a cost of explicitly representing symbols associated with the phrases.