The invention relates to a network behavior alarming system and method in network auditing. And the system comprises alarm policy management module for setting alarm contents and alarm mode, network data analysis module and alarm module for sending out one or multiple alarms; and the method comprises setting and storing alarm contents and alarm mode, and analyzing network data: if there are contents needing alarm, sending out an alarm in the set alarm mode. And it matches sensitive information keywords with network data, analyzes network data and alarms in three modes: sound, short messages and E-mail, thus informing the manager in time and in high efficiency. |