Abstract: This paper gives an overview of different kinds of behavior-based anomaly detection technologies. It compares two classes of IDS-HIDS and NIDS, introduces the role of HIDS in Internet security and the classification of technologies it adopts. After that, it describes both static analysis technologies of HIDS anomaly detection by explaining their basic concepts, development and effects, with a focus on system-behavior based methods. At last, this paper concludes the current situation, future hot topics and prospect of behavior-based HIDS.