With the increasing complexity of cyber attacks and the growing volume of heterogeneous security alerts, traditional intrusion detection systems(IDS)face challenges in handling data redundancy, class imbalance, and contextual semantic modeling. To address these limitations, this paper proposes MT-BERT, a multi-task learning framework integrated with protocol-aware BERT embeddings, for joint attack detection and fine-grained classification. By leveraging a hierarchical architecture, MT-BERT synchronously optimizes two tasks: (1) binary anomaly detection (Task A) and (2) multi-class attack type identification (Task B). The core innovations include: (a) Protocol symbolization that transforms raw traffic features (e.g., protocol types, service flags) into contextual token sequences, enabling BERT to capture syntax-aware semantic representations; (b) A domain-adaptive fine-tuning strategy that aligns pre-trained BERT embeddings with cybersecurity-specific patterns; (c) A weighted multi-task loss function to balance feature sharing and task-specific optimization. Evaluated on the NSL-KDD benchmark, MT-BERT achieves an F1-score of 94.8%for anomaly detection (Task A) and 89.4%for attack classification(Task B), outperforming state-of-the-art baselines (e.g., BiLSTM-MHA,CNN-LSTM) by 2.0–9.7%.Ablation studies confirm the necessity of multi-task synergy and BERT-based semantic encoding, where removing either component degrades the weighted Score by 5.6–11.3%.The framework demonstrates strong robustness to rare attack types (e.g.,34.7%F1 improvement on U2R attacks) and provides a unified solution for alert denoising and threat categorization, significantly reducing false positives in practical deployments.