To solve the open problem of predicting intrusion in Reactive Intrusion Tolerance System, a hybrid Bayesian network method is presented in this paper. Firstly, an intrusion model is presented, which pays its emphasis on the influence of the intrusion upon the system and describes the intrusion as the state transition process of the attackers' capability. The intrusion model is appropriate to trig the reactive intrusion tolerance system. We proposed the constructing algorithm and the proof of its feasibility. Secondly, a hybrid Bayesian network model based on this intrusion model is presented to show the casual relation of the attack behavior and secure state. The model is divided into two layers: attack behavior layer and secure state layer, in which the attack edges and state nodes of intrusion model are used as nodes in behavior layer and state layer respectively. In this hybrid Bayesian network model, the connections of the same layer are continuous, but that of the different layer are converge. The algorithm for computing the joint probability distribution of the hybrid Bayesian network is presented. In the end, the efficiency of the intrusion model and hybrid Bayesian network in predicting intrusion is shown by the experiment with our belief propagation algorithm, and the advantages of this predicting method over the related work are shown by analysis and comparisons.