The invention relates to an industrial Internet intrusion detection method based on a capsule network, and belongs to the technical field of Internet security. The method comprises: firstly, subjecting data to imaging processing so as to recognize abstract features; then constructing a feature extraction front end by using an ultra-deep convolutional neural network, and meanwhile, introducing a global average pooling layer to improve the quality of an extracted feature map. On this basis, a dynamic routing algorithm is introduced, intrusion data features are clustered in an iterative mode, and detection and classification of various attacks are completed in a capsule network module. According to the method, multiple pooling layers are used for greatly reducing the data dimension, and thespace complexity of the algorithm is reduced. In a back propagation (BP) process, an Adam method is used as an optimization algorithm, a model training learning rate is dynamically adjusted, and stable convergence of the model is ensured to achieve an optimal effect. Compared with the prior art, the method is high in detection accuracy and lower in false alarm rate and missing report rate in industrial Internet networking intrusion detection.