Abstract: An intrusion detection method based on rough set is proposed in order to overcome poor generalizing ability of current intrusion detection system in the case of less prior knowledge. According to rough set a detection model is built based on short call sequence and used to detec call sequences of sendmail program.The experimental proves that better detecting result can be obtained while less normal and abnormal information is needed.