1. An intrusion masquerade detection method, comprising: applying a compression algorithm to one or more sets of user input content data to build a set of user grammars; forming at least one model for the set of user grammars using characteristics of the set of user grammars, the characteristics including a first estimated algorithmic minimum sufficient statistic for the set of user grammars; storing the at least one model for the set of user grammars in a database; calculating a second estimated algorithmic minimum sufficient statistic for at least one target block of other input content data by applying the compression algorithm to the at least one target block of the other input content data; determining a distance between the at least one target block of the other input content data and the at least model for the set of user grammars by comparing the first estimated algorithmic minimum sufficient statistic and the second estimated algorithmic minimum sufficient statistic; determining an intrusion masquerade based on the determined distance; and outputting an indication of the determined intrusion masquerade.
1. An intrusion masquerade detection method, comprising: applying a compression algorithm to one or more sets of user input content data to build a set of user grammars; forming at least one model for the set of user grammars using characteristics of the set of user grammars, the characteristics including a first estimated algorithmic minimum sufficient statistic for the set of user grammars; storing the at least one model for the set of user grammars in a database; calculating a second estimated algorithmic minimum sufficient statistic for at least one target block of other input content data by applying the compression algorithm to the at least one target block of the other input content data; determining a distance between the at least one target block of the other input content data and the at least model for the set of user grammars by comparing the first estimated algorithmic minimum sufficient statistic and the second estimated algorithmic minimum sufficient statistic; determining an intrusion masquerade based on the determined distance; and outputting an indication of the determined intrusion masquerade. 2. The intrusion masquerade detection method of claim 1 , the at least one model for the set of user grammars comprising a healthy session model and a masquerade model.