Abstract: As a basic technology of distributed computing and mobile computation, mobile agent becomes a focus of researches. Due to its migration in Internet and then execution in many unknown hosts, a new security problem is introduced: how to protect the mobile agent being attacked by some hosts? This is the problem of malicious hosts. In order to detect malicious host’s attacks, a method based on reference states is suggested. But the overhead of this method is too large. In this paper, it is supposed to be enough to record the inputs and the results of mobile agent only. According to this point, a new protocol named PTIR （a protocol tracing inputs and results to detect malicious host’s attacks） is built up to detect the attacks of malicous hosts. Compared with other protocols, the overhead of this protocol is low.