Based on full-traffic mirror and big data processing technology, the traffic audit bypass analyzes the user's authorized traffic log, identifies the web application attack rapidly, so as to mine the attack events deeply like remote command execution of web, webshell backdoor, sensitive file leakage against hacker and make accurate alarm; store original web traffic log and audit report to meet the requirements of cyber security classified protection compliance.