The invention discloses a network anomaly traffic monitoring method, belonging to the technical filed of information security. The network anomaly traffic monitoring method comprises the steps of: capturing a network data stream passing by; according to generation time of the network data stream, selecting n network data streaming data which are closest to the current time, wherein n is determined according to the calculating capacity of a system; training the captured n network data streaming data as input of a relevance vector machine, establishing a data model; and monitoring the current network traffic data according to the data model. By the method and the device, the classifying monitoring precision can be improved so that anomaly traffic is monitored more rapidly and effectively, and lower false drop rate and fallout ratio are ensured.