wIDSard is a host-based Intrusion Detection System for i386 Linux platform. It intercepts, at user level, system calls specified in a configuration file written by the user. A finite-state automater is used to trace the monitored process. The language used for the configuration file is regular expression based. If a particular sequence of system calls is intercepted than an appropriate action could be executed.
You can download it from the following link: https://packetstormsecurity.com/files/download/31269/widsard-0.1.tar.gz
Source: https://packetstormsecurity.com/files/31269/widsard-0.1.tar.gz.html