The invention discloses an active defense network security analysis method, a storage medium and an application server. The method is based on a dual-model architecture combining a fused GSPN and a Markov chain. The method comprises: determining an attack success probability and average attack time of a preset system through a GSPN model; and determining a corresponding function relationship between the system parameters and the attack success probability through a Markov chain, and finally analyzing the security of the active defense network according to the attack success probability, the average attack time and the corresponding relationship between the system parameters and the attack success probability. Through integrating a dual-model architecture combining the GSPN and the Markov chain, undistorted description can be carried out on attack details such as behaviors among attacker defenders, high expandability among different systems is achieved, the corresponding relation between the attack success rate and system parameters can be determined, and the comprehensiveness and flexibility of security analysis are improved. In addition, the two models can supplement each other and verify each other, and the accuracy of safety analysis is further improved.