Along with the rapid improvement of Internet, the malicious behavior of network users affects computer networks negatively. An anomaly detection method of network user behaviors based on artificial immune systems is proposed to conquer the above problem. Real-time network data are captured to attain the network behaviors. Their signatures are extracted to simulate the data style in artificial immune systems. Immune elements are simulated to analyze the behavior mode. Immune principles and mechanisms are adopted to detect abnormal behaviors of network users. Meanwhile, alarm and evidence of abnormal behaviors are formed. The proposed method provides a novel approach for anomaly detection of network user behaviors. Experiment results show that it is more effective than existing methods.