Aiming at the situation that the existing intrusion detection models perform poorly on unknown attacks and have extremely limited labeled data, an intrusion detection model named SSL-3WD based on Semi-Supervised Learning (SSL) and Three-Way Decision (3WD) was proposed. In SSL-3WD model, the excellent performance of 3WD in the case of insufficient information was used to meet the assumption of sufficient redundancy of data information in SSL. Firstly, the 3WD theory was used to classify network behavior data, then some appropriate "pseudo-labeled" samples were selected according to the classification results to form a new training set to expand the original dataset. Finally, the classification process was repeated to obtain all the classifications of network behavior data. On the NSL-KDD dataset, the detection rate of the proposed model was 97.7%, which was 5.8 percentage points higher than that of the adaptive integrated learning intrusion detection model Multi-Tree, which has the highest detection rate in the comparison methods. On the UNSW-NB15 dataset, the accuracy of the proposed model reached 94.7% and the detection rate reached 96.3%, which were increased by 3.5 percentage points and 6.2 percentage points respectively compared with those of the best performing one in the comparison methods, the intrusion detection model based on Stack Nonsymmetric Deep Autoencoder (SNDAE). The experimental results show that the proposed SSL-3WD model improves the accuracy and detection rate of network behavior detection.