Due to the lack of efficiency and stability of traditional intrusion detection systems deployed in the resource-constrained devices, an intrusion detection system for intelligent substations was proposed by optimizing the system performance without affecting the efficiency of the main station system. The analysis system was based on network intrusion detection structure and optimized data storage to provide for the further security analysis, also proposed a risk value calculation algorithm based on the three-dimensional degree of information security, which can intuitively determine the scope and extent of the impact of the attack on the system, adjusted the system to satisfy the needs of passive, low load, real-time and reliability. Experimental results show that the system can effectively detect intrusion attacks and has stable performance while meeting the protection requirements in intelligent substation devices.