The invention relates to the field of text processing, aims to solve the problems existing in the prior art and provides a text characteristic modeling method and device for network security reports. The method or the device combines with full text and paragraph information and meanwhile combines with word frequency and text characteristic information to establish a text model in the specific field; network security analysis is conducted on network security reports needing analysis. Document analysis is mainly based on paragraphs, documents are read firstly, the paragraph text density and key word frequency of full texts are calculated, then position information, length information, key field information and paragraph vectors are extracted from paragraphs and form characteristic vectors of the paragraphs, and then the paragraphs are classified according to the characteristic vectors. After the analysis of all the paragraphs is completed, a full-text data model can be established.