The anomaly detection problem can be formulated as one of learning to
characterize the behaviors of an individual, system, or network in
terms of temporal sequences of discrete data.  We present an approach
to this problem based on instance based learning (IBL) techniques.  To
cast the anomaly detection task in an IBL framework, we employ an
approach that transforms temporal sequences of discrete, unordered
observations into a metric space via a similarity measure that encodes
intra-attribute dependencies.  Classification boundaries are selected
from an a posteriori characterization of the valid user's
behaviors, coupled with a domain heuristic.  An empirical evaluation
of the approach on user command data demonstrates that we can
accurately differentiate the profiled user from alternative users when
the available features encode sufficient information.  Furthermore, we
demonstrate that the system detects anomalous conditions
quickly --- an important quality for reducing potential damage
by a malicious user.  We present several techniques for reducing the
data storage requirements of the user profile, including instance
selection methods and clustering.  An empirical evaluation shows that
a new greedy clustering algorithm reduces the size of the user model
by 70% with only a small loss in accuracy.