This paper presents a Trojan-detection system model based on behavior analysis. Through the abstract description of the Trojan's behavior, according to certain rules to establish a behavior feature database, and combining the heuristic analyzer to further analysis and judge whether the program is the Trojans, then do the appropriate processing at last. The experiments show this method is effective and efficient in real time and light load, and can be used to in practice to monitor the computer system in real time.