The invention discloses a method for identifying a disturbance event in a distributed type optical fiber pipeline security early-warning system. When the disturbance event exists, wavelet de-noising is conducted on two routes of sampling signals. The characteristic values of one sampling signal where wavelet de-noising is conducted are extracted, wherein the characteristic values include the vibration fragment length, the time domain energy, the k-order original point distance, the k-order center distance, the skewness, the kurtosis and low frequency wavelet coefficient energy Ej, obtained through wavelet decomposition, of all layers, and j ranges from 1 to 7. The thirteen extracted characteristic values are sent to a decision tree classification device, and the type of the disturbance event is obtained through the decision tree classification device. Man-machine interaction incremental learning is achieved by changing the type of the disturbance event stored in a database under the condition that a new type of the disturbance event appears or the type, obtained through the decision tree classification device, of the disturbance event is wrong, and online training is conducted on the decision tree classification device according to the modified type of the disturbance event. By means of the method, the type of the disturbance event can be accurately obtained.