Computer network defense decision-making method and system

The invention discloses a computer network defense decision-making method and system, and the system comprises a plurality of data sites and a data processing platform which is used for processing each data site, and the data sites are used for storing original data generated when a user logs in a network. The data processing platform comprises a network data acquisition unit, a cache space, a data classification unit, a data analysis unit and a data analysis unit, and the decision-making method comprises the following steps: acquiring original data of each data site, and classifying the original data according to data types; and analyzing each data network address of the classified original data in sequence according to the user network transmission log, identifying whether each data network address has a real user name or not, analyzing the original data, outputting an analysis processing result, and sending a processing measure to the data site according to the analysis result. 本发明公开了及一种计算机网络防御决策方法及系统，包括若干