Dynamics and complexity of the Internet security environment make that real-time and dynamic auditing of network behavior security is more difficult. For the resolution of difficulties on dynamics and complexity in the network behavior audit, an architecture of real-time and dynamic audit for network behavior security under the Internet environment is created. The proposed architecture consists of pretreating network behavior data, synchronizing network data, dynamically recognizing network behavior and comprehensively auditing network behavior security. Pretreating network behavior data solves the problems of the integrity of network behavior data to be treated and the scientific modeling of network behaviors. Synchronizing network data solves the problem of real-time treating of network behavior data. Dynamically recognizing network behavior uses and simulates immune mechanisms to realize the dynamic auditing for network behavior security. Comprehensively auditing network behavior security solves the problem of direct service of audit results of network behavior security for the network security management. The proposed architecture is expected to provide a new reference for the establishment of active network security management model.