1. A method for automatically generating a valid behavior specification for use in an intrusion detection system for a computer system, comprising: receiving an exemplary set of system calls that includes positive examples of valid system calls, and possibly negative examples of invalid system calls; and automatically constructing the valid behavior specification from the exemplary set of system calls by selecting a set of rules covering valid system calls; wherein the set of rules covers all positive examples in the exemplary set of system calls without covering negative examples; wherein selecting a rule for the valid behavior specification involves using an objective function that seeks to maximize the number of positive examples covered by the rule while seeking to minimize the number of possible system calls covered by the rule.