The invention discloses a container-based multi-system intrusion monitoring method and device. Multiple systems at least comprise a first system and a second system, wherein the first system and the second system share a core. The method comprises the following steps: the core sends a checking capability signal to the first system when the core finds that the permission of an application and/ or service program is changed; the first system determines permission change types according to the received checking capability signal, wherein the permission change types comprise a normal permission change type and an abnormal permission change type; when a determination result shows that the permission change type is the abnormal permission change type, the first system sends a service stopping signal to the second system; and the second system sends a process termination signal to the application and/ or service with abnormal permission change according to the received service stopping signal to terminate the corresponding application and/ or service. The method and the device can independently and effectively monitor system intrusion without interruption, and makes corresponding processing so as to protect user privacy and avoid possible losses.