Abstract: The combination of deep learning and intrusion detection has become a hot topic in cyberspace security. In unstable network security situation, how to accurately detect abnormal traffic is an important task for intrusion detection. Each sample in the intrusion data contains multiple features, but not every feature can determine the final nature of the sample. Some features will even affect the judgment ability of the model. To solve this problem, an intrusion detection model based on residuals of a double routing deep capsule network is proposed. The model uses a deep capsule network to enhance the identification and extraction of features, which can extract higher dimensional data features. A hybrid attention mechanism is used to process the raw data so that the model focuses on features with high impact factors. The model captures the features based on vector representation and clusters the features in multiple directions by a dual routing algorithm. It adopts two strategies, namely residual connectivity and noise capsules, to stabilize the dynamic routing process to mitigate the interference of noisy features. Finally, experiments are conducted on the NSL-KDD dataset and CICIDS2017 dataset, and the results show that the accuracy is up to 90.31% and 99.23%, respectively.