The invention provides a method and a device for analyzing user behaviors. The method and the device for analyzing the user behaviors are used for solving the problem that in the prior art, the user behaviors can not be analyzed aiming at an identity of a user. The method includes that a log analysis server acquires a authentication message interacted between the user and a radius server, a corresponding relation between a request source IP address and user name information is extracted, a domain name resolution message interacted between the user and a domain name server (DNS) node is obtained, a corresponding relation among the request source IP address and request domains is extracted, a corresponding relation among the user name information and the request domains is set up, and the user behaviors are analyzed based on the corresponding relation among the user name information and the request domains. Due to the fact that the user and a message interacted between a radius authentication system and a DNS domain name analysis system are obtained, the corresponding relation among the user name information and the request domains is set up, and thus the user behaviors can be analyzed aiming at the identity of the user.