The invention relates to an automatic suspicious encryption channel discovering and alarming system. The automatic suspicious encryption channel discovering and alarming system is characterized by comprising a processor, an alarming module, a database and a monitoring system, the processor is connected with the alarming module and the monitoring system, the database includes a suspicious behavior set and a suspicious database body, monitored channel data are matched with the suspicious behavior set and the suspicious database body in the database through the monitoring system, suspicious behaviors and suspicious data are discovered if matching is successful, and if not, the alarming module is started. The automatic suspicious encryption channel discovering and alarming system has the advantages that an encryption channel is monitored in real time, alarming is performed in the channel is discovered to be suspicious, safety in the encryption channel is improved, and information of people in network activities and some related materials are further guaranteed.