INTRUSION DETECTION DEVICE AND INTRUSION DETECTION METHOD

An intrusion detection device includes a connection interface and a processor. The processor is configured to obtain a network protocol data and an industrial operation data of each of the plurality of first packets; tag a first internet protocol (IP) address of the network protocol data with a first action role and tag a second internet protocol (IP) address of the network protocol data with a second action role respectively; obtain a related group of the first IP address, wherein the related group comprises a first industrial device information and a second industrial device information; and generate a rule list, wherein the rule list comprises the first action role, the first IP address, the second IP address, and contents of the related group, which the first action role on the rule list corresponds to the first industrial device information and the second industrial device information.