7. A machine-implemented grammar inference engine for intrusion detection, comprising: a pre-processor apparatus that receives input data and outputs filtered data; a grammar generator apparatus coupled to the pre-processor apparatus and configured to generate grammars associated with a user by applying a compression algorithm to the filtered data, to form at least one model by storing the user grammars in a database, and to apply the compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic; a grammar applicator apparatus that searches a string of data from the at least one target block for phrases matching user grammars contained in the at least one model, sorts the user grammars so that longest phrases among the user grammars are applied first to an unclassified string, replaces each matching phrase with a variable-length code value, and attributes a cost for phrases that are not found in the at least one model by quantifying a cost of explicitly representing symbols associated with those phrases; and a classifier apparatus coupled to the grammar applicator apparatus and to a post-processor apparatus, the classifier apparatus receiving the cost from the grammar applicator apparatus and decision criteria from the post-processor apparatus, the classifier apparatus being configured to determine a degree of fit between the at least one target block and the at least one model based on the cost and the decision criteria, to detect an intrusion masquerade based on the degree of fit, and to output an indication of the detected intrusion masquerade, wherein the post-processor apparatus assigns each portion of the input data to one of the models.
7. A machine-implemented grammar inference engine for intrusion detection, comprising: a pre-processor apparatus that receives input data and outputs filtered data; a grammar generator apparatus coupled to the pre-processor apparatus and configured to generate grammars associated with a user by applying a compression algorithm to the filtered data, to form at least one model by storing the user grammars in a database, and to apply the compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic; a grammar applicator apparatus that searches a string of data from the at least one target block for phrases matching user grammars contained in the at least one model, sorts the user grammars so that longest phrases among the user grammars are applied first to an unclassified string, replaces each matching phrase with a variable-length code value, and attributes a cost for phrases that are not found in the at least one model by quantifying a cost of explicitly representing symbols associated with those phrases; and a classifier apparatus coupled to the grammar applicator apparatus and to a post-processor apparatus, the classifier apparatus receiving the cost from the grammar applicator apparatus and decision criteria from the post-processor apparatus, the classifier apparatus being configured to determine a degree of fit between the at least one target block and the at least one model based on the cost and the decision criteria, to detect an intrusion masquerade based on the degree of fit, and to output an indication of the detected intrusion masquerade, wherein the post-processor apparatus assigns each portion of the input data to one of the models. 10. The grammar inference engine of claim 7 , wherein the pre-processor is further configured to apply a sliding window protocol to segment portions of the input data.