The invention discloses a method using multi-dimensional feature vectors to detect an IP ID covert channel. The method comprises the following steps of the feature extracting step 1 of respectively and continuously capturing N IP data packets for normal and abnormal training samples, extracting information of an ID domain of the head of an IP, acquiring the ID difference value of delta id1, delta id2,..., delta idn-1 between adjacent data packets, and carrying out statistics on a mean value E, a standard deviation D and an entropy of the id1, delta id2,..., delta idn-1 to obtain three-dimensional feature vectors, the step 2 of carrying out training on an SVM classifier, repeating the step 1 to obtain a three-dimensional feature vector set of the normal training samples and a three-dimensional feature vector set of the abnormal training samples, and carrying out training on the SVM classifier to obtain a classifying detecting model, and the step 3 of classifying the feature vectors of a channel to be detected through the SVM classifier according to the trained and obtained classifying model. The method is high in detecting efficiency, uses multi-dimensional statistic features as classifying data and improves the detection accuracy.