In recent years, network attack behavior show diversity. Feature code matching is commonly used for network intrusion detection in network defense. Even though the feature library can be updated constantly, the linkage between invasion features are not fully considered in the traditional matching algorithms. The lack of dynamic analysis of invasion form reduces the accuracy of attack classification and network threat detection. In order to solve this problem, dynamic detection method of network intrusion features based on a poor fuzzy localization algorithm is proposed. By establishing and analyzing the network intrusion feature set, the new algorithm uses poor dynamic feature matching algorithm to correct the disadvantages caused by fuzzy features maximally. In the matching process, fewer invasion feature points are used for subsequent multiple matching, which can shorten the matching time and eliminate matching errors. The experimental results show that this improved algorithm on intrusion detection can effectively improve the accuracy of detection.