Experimental results demonstrate the proposed method can accelerate the intrusion process, relieve detection load, improve detection rate, decrease false positive and false negative rate.