The invention relates to the technical field of electric power information security, and discloses a method and a device for generating association rules of abnormal events of a power network, wherein, the method comprises the following steps of: acquiring a plurality of abnormal events; based on the preset classification model, the abnormal events are classified to get the positive and negative examples, wherein the preset classification model is obtained by training the neural network model with sample abnormal events; forming a plurality of preset association rules by using a positive example set; preset association rules are trained according to the preset algorithm, the positive example set and the negative example set to generate the association rules of the abnormal events. By classifying some abnormal events according to the attack scene based on neural network model and combining with preset algorithm (such as improved genetic algorithm), the method ensures the global optimization and improves the accuracy of the generated association rules. Furthermore, the initialization scheme, crossover and genetic probability of genetic algorithm are improved, that is, the adaptive crossover probability and genetic probability are set to improve the accuracy of association rules.