An anomaly intrusion detection method based on a HMM is given.We pass the system call trace of unix privileged process into a HMM to get state transition sequences.Preliminary experiments prove the state transition sequences can express the different mode between normal action and intrusion behavior more stably and more simply than the short sequence in TIDE can do.Although building a HMM is computationally expensive

we can get three advantages

that is

smaller profile database

needing smaller training data

and greater difference between normal data and abnormal data.So we can detect more quickly and with lower false positive rate.