The present invention discloses the method and apparatus for topology discovery enabled intrusion detection. In information and communications technology (ICT) systems, end devices are organized into subnets that are communicated with the system center through the multi-service gateways. Any intrusion can incur the variations of the communications environments and the subnet topologies. The potential external intruding devices are detected by the varied communications environments and identified by the difference between the original and new subnet topologies constructed by the topology discovery method. The information of potential external intruding devices is sent to the system center for device authentication. If passed, the device is kept associated and the system topology is updated with the newly discovered subnet topology. If failed, the device is enforced to disassociate, and an enhanced secure mode is triggered where the messages communicated over the intruded subnet are encrypted.