〗In order to solve the problem that network security incidents occurred frequently and anomaly detection methods are mostly focused on the modeling of the system call data,an intrusion detection method based on hidden Markov model was proposed.Joint information of system calls and function return address chain was used to establish the host process of hidden Markov model.In addition,a fast algorithm was designed to train the parameters of the model.The experimental results showed that the introduction of joint information of system calls and function return address chain could effectively distinguish between normal behavior and abnormal behavior of the process,and significantly reduce the operation time.
