Network security defense method and system for autonomously identifying attack monitoring

The invention discloses a network security defense method for autonomously identifying attack monitoring, which relates to the technical field of network security, and comprises the following steps: collecting data in real time and preprocessing the data, and establishing an abnormal database through a twin training model to form an abnormal data source; the inspection assistant judges the attack behavior essence by using the autonomous recognition model according to the number of the trigger sources, triggers the threat intelligence analysis library and adopts multi-level defense deployment; and when the data source system is not triggered to keep normal, performing whole-process abnormal behavior detection by using an abnormal inspection assistant, and performing feedback optimization. According to the method and the device, the possibility of false report and missing report is reduced, the requirement of manual intervention is reduced, the network data is quickly acquired and sorted, the subsequent analysi