To solve the problems of low detection accuracy, high false positive rate and unbalanced network data sets in the high-dimensional massive data environment of traditional intrusion detection model, an intrusion detection model based on improved Stack autoencoder (SAE) and bidirectional feature attention short-time memory network (BALSTM) is proposed. In the model, firstly, Smote-Tomek combined sampling algorithm is used to reduce the imbalance rate of data sets, and then batch standardization and early stop mechanism are used to improve SAE for feature extraction, which accelerates the convergence speed of the model and solves the over-fitting problem. Finally, an attention module is added to BLSTM, which enables BALSTM model to pay attention to context information and strengthen the learning of important features. Analysis and simulation results show that the model has better performance in accuracy and false alarm rate.