A change in behavior for intrusion detection