Security system and method for detecting intrusion in a computerized system

A system for detecting whether a current user is or is not the same as an intended user of a computer or similar device or for identifying a current user of a computer or similar device, the system comprising:

• a monitoring module for all the time or continuously detecting interactions or activities of the user with or through the computer or similar device,
• at least one testing module connected to the monitoring module for directly, after the monitoring module has detected an interaction or an activity, analyzing the interaction or activity, the at least one testing module arranged to then for decide, in particular also considering recorded data of a previously detected activity or interaction, whether the detected interaction or activity belongs to a predetermined model of user behavior,
• a buffer connected to the at least one testing module for storing, in the case where the at least one testing module has decided that the detected interaction or activity belongs to the predetermined model, data of the detected interaction or activity,
• the at least one testing module further arranged to analyze the data stored in the buffer to find whether sufficient data are stored in the buffer, or whether the buffer is full in the case where the buffer has a predetermined length,
• a comparator connected to said at least one testing module and the buffer for using, in the case where the at least one testing module has decided that there are sufficient data stored in the buffer or the buffer is full, the data stored in the buffer for comparing to data in a behavior profile of a user, and
• the comparator further arranged to signal or indicate, in the case where the result of the comparing by the comparator is that the data stored in the buffer does not sufficiently agree with or is not sufficiently in line with said data in the behavior profile, this result to give an alarm, or provide the result for an evaluation or validation whether the current user is or is not the same as the intended user or use the result for identifying the current user, and otherwise to discard the data stored in said buffer.