In wireless sensor networks (WSNs), aiming at the problems that internal attacks such as network congestion and high energy consumption seriously threaten the network security and normal operation, an intrusion detection technology based on traffic prediction is proposed. Firstly, the technology uses the autoregressive moving average model ARMA (autoregressive moving average) to establish the ARMA traffic prediction model for the node and then uses the predicted traffic value to obtain the traffic reception rate range through the node. Finally, the detection effect is achieved by comparing whether the actual service reception rate exceeds the prediction range. The experimental results show that, compared with the single ARMA model, under the same message playback rate, this technology has higher detection rate and lower false alarm rate and reduces the energy consumption of network nodes.