The invention belongs to the field of network security visual analysis and relates to a website abnormal access behavior detection method based on the visual analysis. The method includes the steps of carrying out preprocessing on log data of a web server, utilizing a visual method to display position, time and content information of the data, utilizing an animation effect to display access events, carrying out clustering analysis on access users, carrying out acquisition and calculation on data attributes, and carrying out pattern discovery on abnormal access behaviors through combination of observation to visual results and clustering results and manual analysis. Compared with a traditional pure-machine computation method, the website abnormal access behavior detection method based on the visual analysis is capable of enabling a user to understand more clearly and visually, fully utilizes human intelligence, finds good balance between intelligent degree and human involvement, and is favorable for improving efficiency of solving problems.