A computer device and a method of identifying whether container behavior thereof is abnormal are provided. The computer device detects container behavior of a container in a time interval, and identifies whether the container behavior of the container is abnormal according to a container behavior identification module, thereby determining whether there is an intrusion. In addition, a decoy container can be installed in the computer device to attract attacking or invading from a third party so as to reduce the risk of the container being attacked, and the container behavior identification module can be updated according to the container behavior of the decoy container.