Abstract: Embodiments of this specification disclose a method and apparatus for detecting intrusion, a storage medium and a device. In this method, a pointcut is set in a dynamic link library of a JVM, a corresponding aspect is initiated at an operating system kernel layer. When the aspect is triggered, the operating system kernel queries, by stack information, a method that is invoked in the dynamic link library by a target event triggering the aspect, and accordingly detects whether the target event is an intrusion event. Since in this method, an intrusion event is detected by a system layer, a system invocation generated by the intrusion can be sensed, even if an intruder directly intruded from a JDWP protocol layer, thereby effectively defending against the event.