Network server defense method based on risk balance

The invention provides a network server defense method based on risk balance. A network server defense system based on the risk balance comprises three parts, namely, an alarm acquisition and response execution part, an event handling part and a display and management part, wherein the alarm acquisition and response execution part comprises various invasion detecting systems and load balancers, the invasion detecting systems complete invasion detection, an Agent residing on the invasion detecting systems achieves standard format conversion and convergence of alarm and sends the alarm to an event handling center for treatment, and the risk balancers receive an invasion response command from the event handling center, and convert the access service process to achieve risk balance of server clusters; the event handling part comprises alarm handling, on-line risk assessment and invasion response decision-making, the alarm handling can be realized through alarm filtering, alarm verification and alarm linkage, so a