The invention discloses an all-network abnormal data stream classification method. The method comprises: step one, abnormal data stream extraction is carried out on an all-network data stream and an abnormal data stream set in the abnormal data stream is outputted; step two, an average value S-P of an abnormal data stream size during per-package counting of the abnormal data stream is calculated, wherein the P is larger than or equal to 1 and is less than or equal to i, an average value B-P of a package size during per-byte counting of the abnormal data stream is calculated, wherein the P is larger than or equal to 1 and is less than or equal to I, at least one feature of the abnormal data stream is extracted, statistics of a distribution entropy H of the extracted feature is carried out, and feature vectorization of the abnormal data stream is carried out by using the S-P, the B-P, and the distribution entropy H of the extracted features as coordinate values to form a point set of a multi-dimensional space; step three, coarse clustering is carried out on the point set by using a Canopy method to obtain a cluster center and a number K value of central points; and step four, according to the cluster center, and the K value, fine clustering is carried out on the abnormal data stream after feature vectorization by using a K-means calculation method and thus a precise classification result of the abnormal data stream is obtained.