Masquerade attacks are attempts by unauthorized users to gain access to confidential data or greater access privileges

while pretending to be legitimate users.This paper proposes a novel method to distinguish legitimate users from masqueraders.The uncertainty of the user's behavior and the relevance of the operation of shell commands are thoroughly considered.The method constructs specific high-order homogeneous Markov chain models to represent the normal behavior profiles of valid users.It defines the states by twofold hierarchical merging shell commands.Therefore this method increases the accuracy of describing the normal behavior profiles

improves the generalization of the detection system and sharply reduces the storage space.In the detection period

taking the real-time performance into account

it computes the categorical boolean variables only using the transition probabilities

which has little computation workload

and then smoothes them to get the decision values used to determine whether the monitored user's behavior is normal or anomalous.Its performance is tested in computer simulation

showing higher detection accuracy and fewer computation costs than related methods'.The proposed method is especially suitable for on-line detection.