A new method called RS-MSVM (Rough Set and Multi-class Support Vector Machine) is pro-posed for network intrusion detection. This method is based on rough set followed by MSVM for attribute re-duction and classification respectively. The number of attributes of the network data used in this paper is re-duced from 41 to 30 using rough set theory. The kernel function of HVDM-RBF (Heterogeneous Value Dif-ference Metric Radial Basis Function), based on the heterogeneous value difference metric of heterogeneous datasets, is constructed for the heterogeneous network data. HVDM-RBF and one-against-one method are ap-plied to build MSVM. DARPA (Defense Advanced Research Projects Agency) intrusion detection evaluating data were used in the experiment. The testing results show that our method outperforms other methods men-tioned in this paper on six aspects: detection accuracy, number of support vectors, false positive rate, false negative rate, training time and testing time. A new method called RS-MSVM (Rough Set and Multi-class Support Vector Machine) is pro-posed for network intrusion detection. This method is based on rough set followed by MSVM for attribute re-duction and classification respectively. The number of attributes of the network data used in this paper is re-duced from 41 to 30 using rough set theory. The kernel function of HVDM-RBF (Heterogeneous Value Difference Metric Radial Basis Function), based on the heterogeneous value difference metric of heterogeneous datasets , is constructed for the heterogeneous network data. HVDM-RBF and one-against-one method are ap-plied to build MSVM. DARPA (Defense Advanced Research Projects Agency) intrusion detection evaluating data were used in the experiment. The testing results show that our method outperforms other methods men-tioned in this paper on six aspects: detection accuracy, number of support vectors, false positive rate, false negative rate, training time and testing time.