The invention relates to a network security protection method based on XDR telephone bill data. The method comprises that: abnormal behaviors of users are identified according to XDR telephone bill data, network security protection is performed then, and identification for the abnormal behaviors of the users Specifically comprises, according to the indexes of the XDR telephone bill data, identifying the abnormal behaviors of the users, wherein the indexes comprise signaling connection times, air interface time, flow, destination or source IP, destination or source port number, data packet number and / or application service type, and the user abnormal behaviors comprise threat behaviors of a network to a user, threat behaviors of the user to the Internet and abuse behaviors of the user to wireless resources. Compared with the prior art, the abnormal behaviors of the wireless user network are effectively monitored, then network security protection measures are taken, bad behaviors of thenetwork are purified, a green and safe network environment is achieved, and the method has the advantages of being wide in recognition range, effective and the like.