A network malicious behavior detection method, including: checking each piece of network packet to determine whether a protocol payload contained therein matches an element in a predetermined protocol payload set, marking each piece of the network packet as a suspicious network packet if the check result is true, and transferring each piece of the network packet to a target device if the check result is false; and performing a malicious behavior checking process on at least one piece of the suspicious network packet, blocking the transfer of at least one piece of the suspicious network packet to the target device if the check result is true, and enabling the transfer of at least one piece of the suspicious network packet to the target device if the check result is false.