For the incompletion of the eigenspace and the poor generalization ability of the pattern classifier in the past cognitive system, an ensemble cognitive method for intrusion behavior based on blending features is explored. Initially, use the Ensemble Empirical Mode Decomposition (EEMD), Power Spectral Analysis (PSA) and Discrete Wavelet Transform (DWT) to extract the information of the distribution tendency of the fiber optic signal on the time domain, frequency domain and the wavelet domain to build a relatively completed eigenspace of the fiber optic signal. And then use the Discriminative Function Pruning Analysis (DFPA) feature subset selection method to evaluate the ability of the feature element to discriminate different kinds of intrusion behavior, and then find the best feature subset. The simplification procedure for the feature group is thus accomplished. Lastly, use the ensemble modeling based on Random Vector Functional-Link net (RVFL) to improve the generalization ability of this cognitive model. Simulation experiment on fiber optic signal collected from the fiber optic perimeter security system based on M-Z(Mach-Zehnder, M-Z)interferometer has shown the effectiveness of this cognitive method.