The invention discloses a real-time confirmation method and a system for safety events, which confirms the safety events in real time efficiently. The method of the invention comprises the following steps: carrying out attack behavior detection on the received network messages, and describing the network messages in which attack behavior is detected as attack messages; extracting the response messages of the attack messages; and matching the response messages by a safety event confirmation rule, and obtaining the attack confirmation result of the attack messages, wherein the safety event confirmation rule is used for judging whether the attack is successful. The invention completes the confirmation of the attack behavior of the safety events in real time by carrying out precise matching on the response messages.