A new model based on deterministic annealing for detecting intruders/users masquerading as other users is presented.In our model
each user is viewed as a discrete stationary source with variable memory.A sequence of characters composed of command lines from a user's account is regarded as the result that is potentially generated by the user and the intruder in different period.We determine masquerades by finding the source(s) in the sequence.Our experiment shows that the model is feasible.