The invention relates to the technical field of electric power information security, and discloses an association rule matching method and device for abnormal events of a power network. The method comprises the following steps: acquiring association rules and a plurality of abnormal events to be matched, wherein the association rules include a plurality of preset abnormal events, and the association rules correspond to a preset attack scenario; converting an exception event to a numeric vector, wherein an abnormal event is a preset abnormal event and an abnormal event to be matched, and the preset abnormal event corresponds to a first numerical vector and the abnormal event to be matched corresponds to a second numerical vector; based on the first numerical vector and the second numericalvector, calculating an association matching degree to determine an attack scenario. The preset abnormal events and abnormal events to be matched in association rules are converted into numerical vectors, and the vector calculation is used to carry out association matching, so that the calculation speed of association matching is improved. Furthermore, the number of abnormal events that need to beassociated matched is further reduced by temporal sequence and business logic (i.e. the elimination of abnormal events), and the speed of association matching is improved.