The invention provides a linkage defense strategy intelligent decision method and system of a security protection device. The method includes steps: when receiving an alarm message, selecting a corresponding defense strategy triggering condition in predefined defense strategy triggering conditions according to an alarm type, and establishing a network attack graph according to a bug related to thealarm message; determining a corresponding linkage defense strategy in a pre-established defense strategy template database according to the selected defense strategy triggering condition, and generating a to-be-selected linkage defense strategy set; calculating system security risk values of the strategies acting on the network attack graph in the set one by one; and determining a final linkagedefense strategy according to the system security risk values. According to the above scheme, acquisition, deep data mining and event associative analysis of IT resource events in a network security domain are performed, and monitoring and management of various security events can be realized; and a decision service is provided for secure operation of an information system based on a development trend of overall information security, and the security of network assets and normal operation of the network are ensured.