Markov chain model, as a statistical method, is an important analytical method. In this paper, Markov chain model used for anomaly detection is in discussed in depth from three aspects, one-step, multi-step Markov chain and multi-step Markov chain-based sequence prediction. The experiments show the method can detect the anomaly behavior of SendMail program without needing any system security knowledge.