The invention discloses a computer network anomaly detection method and system and a mobile terminal in the technical field of network security. The detection method includes the following specific steps: S1, monitoring and analyzing activities of a user and a system; S2, checking system configuration and bugs; S3, identifying known attacks and sending an alarm to the relevant personnel; S4, performing statistical analysis on daily behaviors of the user and the system; S5, evaluating the integrity of important systems and data; and S6, operating system log management, and identifying the useractivities that violate security policies. According to the scheme of the invention, the detection system is arranged on each node of the network, so that attackers cannot easily transfer evidences, strong detection real-time performance can be achieved, the possibility of the own attacks can be reduced, and meanwhile, by adopting the high learning and adaptive capabilities of a neural network, new intrusion behavior features can be identified with high accuracy, and the new intrusion behavior features and variant forms of the known intrusion behaviors can also be identified with a certain probability.