The invention relates to a method for detecting the unknown abnormal behaviors of a website, and the method comprises the steps: obtaining original website information, carrying out the preprocessing and learning, and completing a directed graph and a webpage in-degree table of the website; detecting the access abnormal data of a single page; giving an alarm if the abnormality is detected, and adding one to the number of alarm times; detecting the access abnormality data of a key service; giving an alarm if the abnormality is detected, and adding one to the number of alarm times; detecting the access abnormality data of a single user; giving an alarm if the abnormality is detected, and adding one to the number of alarm times; counting the alarm times, and detecting the number of alarm times of a website HTTP protocol status code; giving an alarm to a website with the number of alarm times of the website HTTP protocol status code being greater than 20 in each half of an hour, carrying out the statistics of abnormal webpage URLs, and carrying out the sorting according to the number of access times; and carrying out the inspection. The method is used for detecting the security flaws of the website and various types of known threats, analyzing the unknown illegal connection and access, carrying out the early warning for a network problem, avoiding the paralysis of a user's network to the greatest extent, and facilitating the subsequent inspection, treatment and maintenance.