提出了一种高效低负荷的异常检测方法 ,用于监控进程的非正常行为 .该方法借助于粗糙集理论从进程正常运行情况下产生的系统调用序列中提取出一个简单的预测规则模型 ,能有效地检测出进程的异常运行状态 .同其它方法相比 ,用粗糙集建立正常模型要求的训练数据获取简单 ,而且得到的模型更适用于在线检测 .实验结果表明 ,该方法的检测效果优于同类的其它方法 . An efficient and low-load anomaly detection method is proposed to monitor the abnormal behavior of the process.The method extracts a simple prediction rule model from the system call sequence generated by the normal operation of the process by means of rough set theory, Which can effectively detect the abnormal running status of the process.Compared with other methods, the training data required to establish a normal model by using rough set is simple to obtain, and the model is more suitable for on-line testing.The experimental results show that the detection method is better than Other similar methods.