The invention provides a method for rapidly detecting and positioning illegal base station intrusion. According to the method, basic network parameters such as LAC, CI and field intensity, acquired by a common user handset and user business behaviors are utilized to determine whether parameter change and the business behaviors are in accordance with various pre-set early warning characteristic conditions, summation of weights in accordance with the characteristic conditions is carried out, whether the present situation belongs to early warning of illegal base station intrusion is determined according to the total weight; when existence of the early warning is determined, a GPS switch of a user is in an open state, present GPS latitude and longitude information of a position of the user is recorded, first-level early warning information is transmitted to a remote central processing unit; report information of multiple terminals are classified by the central processing unit according to LAC codes before attack, secondary integrated alarm analysis on one type of early warning information is carried out to determine whether pre-set alarm characteristic conditions are satisfied, summation of weights in accordance with the alarm characteristic conditions is carried out, whether the present situation belongs to illegal base station intrusion alarm is determined according to the total weight, after existence of the alarm is determined, an illegal base station position during the present illegal base station intrusion is calculated, and real-time alarm is carried out.