The present invention discloses a network abnormal traffic analysis method, which calculates a set of index values of a monitored server based on the acquired IP network data, performs a primary detection on the calculated set of index values to generate vector corresponding to the set of index values, and performs a secondary detection on the vector to determine whether abnormal traffic and abnormal types related to the monitored server exist. The present invention also relates to a network abnormal traffic analysis apparatus related therewith and a network traffic monitoring system and method adopting these network abnormal traffic analysis method and apparatus.