The invention discloses a detection method for abnormal behaviors based on a user access sequence. The detection method comprises the following steps: 1) capturing data from a local network, preprocessing the data, and performing serializing treatment on the acquired data; 2) storing a sequence formed in the step 1 into a
sequence database, and generating a behavior sequence of each user on the basis of time; and 3) calculating the behavior similarity and the
correlation coefficient between users according to the behavior sequence of each user, comparing the
correlation coefficient for detecting the abnormal behaviors, and searching for the abnormal behaviors of the user. According to the method, on the basis of
sequence pattern excavation, factors, such as, time and user behavior characteristics, are fully considered, an improved more accurate user behavior similarity
algorithm is utilized to calculate, and the
sequence rule of the user access is effectively extracted, so that an analysis result is more accurate and the defects of other analysis methods are overcome. Besides, on the basis of the user behavior similarity
algorithm, the method has obvious advantages in
noise interference, the used resources are few, and the running efficiency is high.