More and more intruders exploit the vulnerabilities of system and applications to intrude the system.This paper introduced an anomaly intrusion detection model analyzing processes' behaviors.It introduces the similarity calculation method based on Vector-space.And it introduces an argument to value the capabilities of system calls to differentiate the process behaviors.Thinking of the characters of the abnormalities caused by intrusions

the detection algorithm adopts the method of locally analyzing.