The invention provides a method for rapidly detecting and positioning illegal
base station intrusion. According to the method, basic network parameters such as LAC, CI and
field intensity, acquired by a common user
handset and user business behaviors are utilized to determine whether parameter change and the business behaviors are in accordance with various pre-set early warning characteristic conditions, summation of weights in accordance with the characteristic conditions is carried out, whether the present situation belongs to early warning of illegal
base station intrusion is determined according to the total weight; when existence of the early warning is determined, a GPS switch of a user is in an open state, present GPS
latitude and
longitude information of a position of the user is recorded, first-level early warning information is transmitted to a remote
central processing unit; report information of multiple terminals are classified by the
central processing unit according to LAC codes before
attack, secondary integrated
alarm analysis on one type of early warning information is carried out to determine whether pre-set alarm characteristic conditions are satisfied, summation of weights in accordance with the alarm characteristic conditions is carried out, whether the present situation belongs to illegal
base station intrusion alarm is determined according to the total weight, after existence of the alarm is determined, an illegal base
station position during the present illegal base
station intrusion is calculated, and real-time alarm is carried out.