Intrusion detection system(IDS) based on misuse couldn't detect undefined intrusion behavior effectively and anomaly detection methods based on statistic ignored multivariable correlations of variables in amount of time.A novel anomaly detection algorithm was proposed.Feature vectors represent the system's attributes with slide window and distribute the normal system sate in n dimension space in this method.The method use rules set evolved with genetic algorithms to cover the abnormal space.Experiment shows that the algorithm improves the detection rate.