In the era of ubiquitous connectivity, the metaverse faces numerous cybersecurity risks. Current metaverse security research primarily focuses on authentication and privacy, with less emphasis on detecting intrusions. There are currently no effective methods to detect specific threats such as security boundary (TDSC’19) and side-channel attacks (USENIX Security’23) in the metaverse. Additionally, most intrusion detection systems are only effective against known attacks and struggle to handle new threats or correlate alerts effectively. To address these issues, we introduce an metaverse system intrusion detection scheme. Our scheme utilize metaverse system logs and isolation forest for anomaly detection, which does not require labeled data, thereby enabling the identification of attacks targeting metaverse applications, even if the attacks are previously unknown. Additionally, we use a provenance graph to establish causal relationships between system entities and to sequence events before and after an attack, aiding in alert correlation and attack scenario reconstruction. The scheme’s effectiveness has been evaluated in a real-world environment, and we have successfully replicated security boundary and side-channel attacks. Experimental results demonstrate that the system can identify potential malicious activities with 99% accuracy and successfully reconstruct attack paths.