30. The non-transitory computer-readable medium of claim 25 , wherein the method further comprises calculating a Hollinger distance between a first frequency table that models the first plurality of user actions and a second frequency table that models the second plurality of user actions.
30. The non-transitory computer-readable medium of claim 25 , wherein the method further comprises calculating a Hollinger distance between a first frequency table that models the first plurality of user actions and a second frequency table that models the second plurality of user actions. 32. The non-transitory computer-readable medium of claim 30 , wherein the method further comprises; calculating a second Hollinger distance between the second frequency table that models the second plurality of user actions and a third frequency table that models a third plurality of user actions; comparing the second Hellinger distance with the Hellinger distance to determine whether the third plurality of user actions is the masquerade attack.