Therefore, it is an effective and practical IDS.The host anomaly ID method based on file system we proposed improves the detection rate while decreasing false oppositive rate.