The present application provides a method and apparatus for detecting intrusion risk, which relates to the field of vehicle network security. The method includes detecting a first abnormal event in anIVI system of a vehicle; detecting a second abnormal event on the CAN bus of the vehicle; analyzing a correlation between a time at which the first abnormal event occurs and a time at which the second abnormal event occurs; determining a risk of the vehicle being invaded based on the correlation. The method detects the abnormal events of the IVI system and the CAN bus respectively, and compares the correlation of the two abnormal events in occurrence time, and the higher the correlation is, the higher the risk of the vehicle being invaded, thereby proposing a simple and easy method for determining the risk of the vehicle being invaded.