The invention relates to the field of network security, and discloses a network intrusion detection method based on element sample sparse representation. The problems that a traditional common intrusion detection method is difficult to deal with unknown network attacks and the false alarm rate of anomaly detection is high are solved. The method comprises the steps that a, a network data collection tool is used to collect network instances to build a training sample set; b, an element sample is extracted from the built network training sample set in a centralized manner, and an element sample set is formed to replace the training sample set; and c, a sparse representation classification method is used to detect network data to be identified, so as to identify the category of the network data to be detected. The network intrusion detection method provided by the invention is applicable to network intrusion detection.