1. An intrusion masquerade detection method comprising:
a computer applying a compression algorithm to user data to build user grammars associated with a user;
forming at least one model by storing said user grammars using a database;
applying said compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic;
searching a string of data from said target block for phrases matching user grammars contained in said at least one model;
sorting the user grammars so that longest phrases among said user grammars are applied first to an unclassified string;
converting each matching phrase to a variable-length code value by replacing each said matching phrase with a corresponding variable-length code value;
attributing a cost for phrases that are not found in the at least one model by quantifying the cost of explicitly representing symbols associated with those phrases;
determining a degree of fit between said target block and said at least one model based on said cost; and
detecting an intrusion masquerade based on said degree of fit.
2. The intrusion detection method of claim 1, wherein said searching is performed in real-time.
3. The intrusion detection method of claim 1,
wherein said variable-length code is a Huffman code, and
wherein said compression algorithm is a grammar-based compression algorithm that estimates Kolmogorov complexity and which forms compressive grammar based on Minimum Description Length (MDL) principles.
4. The intrusion detection method of claim 1,
wherein said forming at least one model is performed using a steepest descent method; and
wherein said at least one model comprises a healthy session model.
5. The intrusion detection method of claim 1, further comprising:
outputting an indication of an intrusion masquerade.
6. The intrusion detection method of claim 1,
wherein said detecting an intrusion masquerade includes calculating an inverse compression ratio over a time period for user data, and comparing said calculated inverse compression ratio to at least one inverse compression ratio associated with a compressed data set of at least one said model, and
wherein said detecting an intrusion masquerade event is based on a difference between said calculated inverse compression ratio and said inverse compression ratio associated with a compressed data set, said difference exceeding a threshold.
7. A machine-implemented grammar inference engine for intrusion detection, comprising:
a pre-processor apparatus that receives input data and is configured to output filtered data;
a grammar generator apparatus coupled to the pre-processor apparatus and configured to generate grammars associated with a user by applying a compression algorithm to the filtered data, to form at least one model by storing said user grammars using a database, and to apply said compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic;
a grammar applicator apparatus that searches a string of data from said at least one target block for phrases matching user grammars contained in said at least one model, sorts the user grammars so that longest phrases among said user grammars are applied first to an unclassified string, replaces each matching phrase with a variable-length code value, and attributes a cost for phrases that are not found in the at least one model by quantifying the cost of explicitly representing symbols associated with those phrases; and
a classifier apparatus coupled to the grammar applicator apparatus and to a post-processor apparatus, wherein the classifier apparatus receives said cost from said grammar applicator apparatus and decision criteria from said post-processor apparatus, wherein the classifier apparatus is configured to determine a degree of fit between said at least one target block and said at least one model based on said cost and said decision criteria, to detect an intrusion masquerade based on said degree of fit, and to output an indication of an intrusion masquerade,
wherein said post-processor apparatus assigns each portion of the input data to one of said models.
8. The grammar inference engine of claim 7, further comprising:
a grammar database coupled to the grammar applicator apparatus and to the grammar generator apparatus; and
an input database coupled to an output of the pre-processor apparatus,
wherein the grammar applicator apparatus is configured to receive filtered data processed by the pre-processor apparatus from the input database.
9. The grammar inference engine of claim 7, wherein said compression algorithm is a grammar-based compression algorithm that estimates Kolmogorov complexity and which forms compressive grammar based on Minimum Description Length (MDL) principles.
10. The grammar inference engine of claim 7, wherein the pre-processor is further configured to apply a sliding window protocol to segment portions of said input data.
11. A machine-readable medium upon which is embodied and stored a sequence of programmable instructions which, when executed by a processor, cause the processor to perform intrusion masquerade detection operations comprising:
applying a compression algorithm to user data to build user grammars associated with a user;
forming at least one model by storing said user grammars using a database;
applying said compression algorithm to at least one target block to calculate an estimated algorithmic minimum sufficient statistic;
searching a string of data from said target block for phrases matching user grammars contained in said at least one model;
attributing a cost for phrases that are not found in the at least one model by quantifying the cost of explicitly representing symbols associated with those phrases;
determining a degree of fit between said target block and said at least one model based on said cost; and
detecting an intrusion masquerade based on said degree of fit; and
outputting an indication of an intrusion masquerade.
12. The machine-readable medium of claim 11, wherein the operations further comprise:
sorting the user grammars so that longest phrases among said user grammars are applied first to an unclassified string.
13. The machine-readable medium of claim 12, wherein the operations further comprise:
replacing each matching phrase with a variable-length code value.
14. The machine-readable medium of claim 13, wherein said variable-length code is a Huffman code.
15. The machine-readable medium of claim 11, wherein said searching is performed in real-time.
16. The machine-readable medium of claim 11, wherein said forming at least one model is performed using a steepest descent method.
17. The machine-readable medium of claim 11, wherein said at least one model comprises a healthy session model.
18. The machine-readable medium of claim 11,
wherein said detecting an intrusion masquerade includes calculating an inverse compression ratio over a time period for user data, and comparing said calculated inverse compression ratio to at least one inverse compression ratio associated with a compressed data set of at least one said model, and
wherein said detecting an intrusion masquerade event is based on a difference between said calculated inverse compression ratio and said inverse compression ratio associated with a compressed data set, said difference exceeding a threshold.
19. The machine-readable medium of claim 11, wherein said compression algorithm is a grammar-based compression algorithm that estimates Kolmogorov complexity and which forms compressive grammar based on Minimum Description Length (MDL) principles.
20. The machine-readable medium of claim 11, wherein said target block comprises a plurality of information packets of an information system.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. An electrical connector receptacle comprising:
a first housing portion;
a tongue extending from the first housing portion and fitted to snap into the first housing portion;
a plurality of contacts in the tongue, wherein a front portion of each of the plurality of contacts is angled such that a front edge is embedded in the tongue;
a shield around the first housing portion;
a mounting bracket attached to the shield;
a first metallic piece between the mounting bracket and the tongue and comprising a plurality of EMI contacts; and
a tape layer between the first metallic piece and the mounting bracket.
2. The connector receptacle of claim 1 wherein the connector receptacle is formed to mate with a second housing portion formed with a device enclosure.
3. The connector receptacle of claim 1 wherein the plurality of contacts comprises at least one ground contact, the ground contact longer than at least one other contact in the plurality of contacts.
4. The connector receptacle of claim 1 wherein the tape layer holds the first metallic piece to the mounting bracket during manufacturing.
5. The connector receptacle of claim 1 wherein the plurality of EMI contacts each has a dome-shaped top.
6. The connector receptacle of claim 1 wherein each of the plurality of EMI contacts has a spherical-shaped top.
7. The connector receptacle of claim 1 wherein each of the plurality of EMI contacts is at an end of a finger portion.
8. The connector receptacle of claim 1 further comprising a plurality of EMI tabs extending from the first housing portion.
9. An electronic device comprising:
a device enclosure, the device enclosure having an opening and forming a first portion of a housing for a connector receptacle; and
a connector receptacle, the connector receptacle comprising:
a second housing portion;
a tongue extending from the second housing portion and fitted to snap into the second housing portion;
a plurality of contacts in the tongue, wherein a front portion of each of the plurality of contacts is angled such that a front edge is embedded in the tongue;
an EMI tab strip including a plurality of EMI tabs extending from the second housing portion;
a shield around the first housing portion and in electrical contact with the EMI tab strip;
a mounting bracket attached to the shield; and
a first metallic piece between the mounting bracket and the tongue and comprising a plurality of EMI contacts, wherein each of the plurality of EMI contacts is at an end of a finger portion.
10. The electronic device of claim 9 wherein each of the plurality of EMI electromagnetic contacts has a spherical-shaped top.
11. The electronic device of claim 9 wherein the electronic device is a portable computing device.
12. The electronic device of claim 9 wherein the electronic device is a portable media player.
13. An electrical connector receptacle comprising:
a first housing portion;
a tongue extending from the first housing portion;
a plurality of contacts in the tongue;
a shield around the first housing portion;
a mounting bracket attached to the shield;
a first metallic piece between the mounting bracket and the tongue and comprising a plurality of EMI contacts, wherein each of the plurality of EMI contacts is at an end of a finger portion; and
a plurality of EMI tabs extending from the first housing portion, wherein each tab is located at an end of a beam, each of the beams attached to a strip, the strip located between the first housing portion and the shield.
14. The connector receptacle of claim 13 wherein the strip is laser welded to the shield.
15. The connector receptacle of claim 13 wherein the EMI tabs, beams, and strip are stamped from a plane of sheet metal, and when a connector insert is mated with the connector receptacle, the plurality of EMI tabs contact the connector insert and the beams deflect in a direction of the plane of sheet metal.
16. The connector receptacle of claim 13 wherein a front portion of each of the plurality of contacts is angled such that a front edge is embedded in the tongue.