The invention discloses a method and a system for protecting documents based on process monitoring. The method comprises the following steps: firstly monitoring a computer system process; monitoring a document operating process, wherein a document deleting process and a document modifying process in the document operating process need to be monitored as a system document is mostly and spitefully operated by racketeer virus by adopting modes of deleting the documents and encrypting the documents; hanging up the process before carrying out deterministic specific operation on the documents; judging whether a process behavior is spiteful or not; carrying out early warning treatment if so; releasing the process if not. According to the method disclosed by the invention, the safety of system documents can be effectively maintained, and user information and property safety are protected.