A network attack pattern determination apparatus, being characterized by comprising: a storage unit, being stored with a plurality of attack patterns (12a,..., 12b, 12c) and a plurality of access records (10a,..., 10b) of a network node, each of the access records (10a,..., 10b) comprising a network address of a host, a time stamp of an access to the network node by the host, and an access content of the access to the network node by the host, each of the attack patterns (12a,..., 12b, 12c) corresponding to at least one attack access relation, and each of the at least one attack access relation being defined by one of the network addresses and one of the access contents; and a processing unit, being electrically connected to the storage unit and configured to retrieve a subset of the access records (10a,..., 10b) as a plurality of attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) according to at least one attack address, the network address comprised in each of the at least one attack address being one of the at least one attack address, wherein the processing unit further divides the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) into a plurality of first groups (16a, 16b, 16c) according to the time stamps of the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) and performs the following operations on each of the first groups (16a, 16b, 16c): creating at least one access relation for each of the at least one attack address included in the first group (16a, 16b, 16c) according to the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) included in the first group (16a, 16b, 16c), each of the at least one access relation being defined by one of the at least one attack address included in the first group (16a, 16b, 16c) and one of the access contents of the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) included in the first group (16a, 16b, 16c), and determining that the first group (16a, 16b, 16c) corresponds to a specific attack pattern among the attack patterns (12a,..., 12b, 12c) according to the at least one access relation corresponding to the first group (16a, 16b, 16c). a storage unit, being stored with a plurality of attack patterns (12a,..., 12b, 12c) and a plurality of access records (10a,..., 10b) of a network node, each of the access records (10a,..., 10b) comprising a network address of a host, a time stamp of an access to the network node by the host, and an access content of the access to the network node by the host, each of the attack patterns (12a,..., 12b, 12c) corresponding to at least one attack access relation, and each of the at least one attack access relation being defined by one of the network addresses and one of the access contents; and a processing unit, being electrically connected to the storage unit and configured to retrieve a subset of the access records (10a,..., 10b) as a plurality of attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) according to at least one attack address, the network address comprised in each of the at least one attack address being one of the at least one attack address, wherein the processing unit further divides the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) into a plurality of first groups (16a, 16b, 16c) according to the time stamps of the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) and performs the following operations on each of the first groups (16a, 16b, 16c): creating at least one access relation for each of the at least one attack address included in the first group (16a, 16b, 16c) according to the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) included in the first group (16a, 16b, 16c), each of the at least one access relation being defined by one of the at least one attack address included in the first group (16a, 16b, 16c) and one of the access contents of the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) included in the first group (16a, 16b, 16c), and determining that the first group (16a, 16b, 16c) corresponds to a specific attack pattern among the attack patterns (12a,..., 12b, 12c) according to the at least one access relation corresponding to the first group (16a, 16b, 16c). creating at least one access relation for each of the at least one attack address included in the first group (16a, 16b, 16c) according to the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) included in the first group (16a, 16b, 16c), each of the at least one access relation being defined by one of the at least one attack address included in the first group (16a, 16b, 16c) and one of the access contents of the attack records (14a,..., 14b, 14c,..., 14d, 14e,..., 14f) included in the first group (16a, 16b, 16c), and determining that the first group (16a, 16b, 16c) corresponds to a specific attack pattern among the attack patterns (12a,..., 12b, 12c) according to the at least one access relation corresponding to the first group (16a, 16b, 16c).