Text this: Practical intrusion analysis