The invention relates to a network safety log template extraction method and device. The method comprises steps: firstly, original safety logs are subjected to data cleaning, and log information after filtering of time and IP addresses is obtained; secondly, the log information which does not containing time and IP addresses are subjected to clustering, and logs with similar formats are classified to the same class; thirdly, for logs in the each class, template words describing formats in the logs are extracted, and the template of the log format is obtained. Concretely, a DBSCAN algorithm or an OPTICS algorithm is employed to cluster logs with similar formats, and template words describing formats in logs are extracted by utilization of an LDA Gibbs sampling algorithm. The device comprises a data cleaning unit, an information clustering unit and a template extraction unit. Priori knowledge is not needed, a template of a network safety log format can be obtained automatically, the system load can be reduced, and operational efficiency and accuracy are raised.