Abstract: The present disclosure discloses a complex network attack detection method based on cross-host abnormal behavior recognition, and the method includes the following steps: 1) firstly collecting kernel log data of a host to construct an intra-host association graph, then employing a graph convolution network (GCN) to extract features, and finally using an autoencoder to detect abnormal nodes in the intra-host association graph; 2) firstly constructing an inter-host interaction graph by using network flow log data, then training a prediction model based on a sequence of the inter-host interaction graph, and finally detecting abnormal edges in the inter-host interaction graph according to prediction differences; and 3) firstly constructing a cross-host exception association graph according to intra-host and inter-host exception detection results, then spreading exception scores by employing a PageRank algorithm, and finally confirming an attacked host based on the exception scores.