ImSafe is a host-based intrusion detection tool for Linux which does anomaly detection at the process level and tries to detect various type of attacks. Since ImSafe doesn't know anything about specific attacks, it can detect unknown and unpublished attacks or any other form of malicious use of the monitored application. ImSafe was created for Linux systems but works on almost every UNIX flavor by watching strace outputs.The tool can be downloaded from: http://imsafe.sourceforge.net/download.htm