Abstract: To overcome the lack of systematic definition of network user 's traffic behavior, high description dimension to network user's traffic behavior and long time to analyze single network user's traffic behavior from massive network data, a method of establishing user's traffic behavior analysis system based on network traffic monitoring was proposed. First, a more complete feature set based on the characteristic of network traffic to describe network user's traffic behavior was established. Second, a feature selection rule based on the deviation distance was proposed to select the optimized feature set for the analysis of massive users' traffic behavior and locate abnormal moment rapidly. Finally, the single network user's traffic behavior to locate the abnormal users who produce abnormal traffic behavior was analyzed. Results show that the system has an excellent detection of the abnormal user's traffic behavior.