The invention discloses a dynamic network topological graph generation method based on logs and graphs, and the method comprises the steps: S1, data collection: collecting the traffic of each server, ssh, ftp and web system logs in a streaming manner; S2, data analysis: analyzing feature information of each server from each type of logs collected in the step S1; S3, graph creating: constructing a directed graph by using the feature information analyzed in the step S2; wherein a connection initiator points to an accessed server in the direction of the edge of the directed graph; and S4, network topology state querying: querying the network topology state by using the directed graph created in the step S3. ,According to logs such as connection and flow between the servers, the relation between the servers is analyzed, the servers with the relation are inevitably in the active state of data exchange, the graph is created after the connection relation is analyzed, network changes can be found at any time, and by utilizing the concept of the graph and related algorithms, network active condition display in any time period and analysis of intranet user behaviors can be carried out according to the edge.