The key technology and main difficulty for optical fiber intrusion pre-warning systems (OFIPS) is the extraction of harmful-intrusion signals. After being processed by a phase-sensitive optical time-domain reflectometer (Φ-OTDR), vibration signals can be preliminarily extracted. Generally, these include noises and intrusions. Here, intrusions can be divided into harmful and harmless intrusions. With respect to the close study of signal characteristics, an effective extraction method of harmful intrusion is proposed in the paper. Firstly, in the part of the background reconstruction, all intrusion signals are first detected by a constant false alarm rate (CFAR). We then reconstruct the backgrounds by extracting two-part information of alarm points, time and amplitude. This ensures that the detection background consists of intrusion signals. Secondly, in the part of the two-dimensional Kolmogorov-Smirnov (K-S) test, in order to extract harmful ones from all extracted intrusions, we design a separation method. It is based on the signal characteristics of harmful intrusion, which are shorter time interval and higher amplitude. In the actual OFIPS, the detection method is used in some typical scenes, which includes a lot of harmless intrusions, for example construction sites and busy roads. Results show that we can effectively extract harmful intrusions.