1. A detection method of malicious codes, applicable to a computer system, said computer system having at least a host, each said host executing at least an application program, and each said application program comprising at least a process; said method comprising the steps of: (a) intercepting all system calls and related arguments from all said processes by a pre-installed system call monitor module on each said host; (b) extracting a plurality of pre-defined system calls from all the intercepted system calls by a malicious code analysis module; (c) determining whether the intercepted pre-defined system calls, arguments, and input data flow include a suspicious malicious code; if not, returning to step (a); (d) executing said suspicious malicious code and generating predicted behavior of said suspicious malicious code; (e) comparing said predicted behavior with actual execution behavior of said suspicious malicious code; if different, returning to step (a); and (f) issuing a warning of intrusion.