Abstract: In view of the complexity of network intrusion detection and malware attacks continuously improve the environment, it is difficult to improve the accuracy of real-time high speed detection, need to disguise layer network intrusion real-time high-speed detection method research. But current method is to use genetic algorithm to optimize the neural network structure, and then combined with the optimized neural network to network intrusion detection alert, the continuing evolution of evolutionary neural network method to find the optimal neural network structure, when evolutionary neural network system in normal working mode, can respond to deviate from the normal work of things, but this method has the problem of real time capability is not strong. For this, Put forward a kind of hierarchical network intrusion real-time high-speed detection method of disguise. On hierarchical network data preprocessing in the first place, the method using ant colony algorithm of hierarchical network invasion of high-speed real-time detection feature selection of disguise, camouflage and combining with the analysis of feature selection for network invasion of high-speed real-time hierarchical clustering method for layered network mask invasion of high-speed real-time detection method research. Simulation experiments show that using the hierarchical network intrusion detection method can effectively improve the accuracy of the real-time high-speed network intrusion detection.