1. An intrusion masquerade detection method, comprising: a computer applying a compression algorithm to user data to build user grammars associated with a user; forming at least one model by storing the user grammars in a database; applying the compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic; searching a string of data from the at least one target block for phrases matching user grammars contained in the at least one model; sorting the user grammars so that longest phrases among the user grammars are applied first to an unclassified string; converting each matching phrase to a variable-length code value by replacing each matching phrase with a corresponding variable-length code value; attributing a cost for phrases that are not found in the at least one model by quantifying a cost of explicitly representing symbols associated with those phrases; determining a degree of fit between the at least one target block and the at least one model based on the cost; and detecting an intrusion masquerade based on the degree of fit.
1. An intrusion masquerade detection method, comprising: a computer applying a compression algorithm to user data to build user grammars associated with a user; forming at least one model by storing the user grammars in a database; applying the compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic; searching a string of data from the at least one target block for phrases matching user grammars contained in the at least one model; sorting the user grammars so that longest phrases among the user grammars are applied first to an unclassified string; converting each matching phrase to a variable-length code value by replacing each matching phrase with a corresponding variable-length code value; attributing a cost for phrases that are not found in the at least one model by quantifying a cost of explicitly representing symbols associated with those phrases; determining a degree of fit between the at least one target block and the at least one model based on the cost; and detecting an intrusion masquerade based on the degree of fit. 6. The intrusion detection method of claim 1 , wherein the detecting the intrusion masquerade includes calculating an inverse compression ratio over a time period for user data, and comparing the calculated inverse compression ratio to at least one inverse compression ratio associated with a compressed data set of the at least one model, and the detecting the intrusion masquerade is based on a difference between the calculated inverse compression ratio and the inverse compression ratio associated with the compressed data set, the difference exceeding a threshold.