To　overcome　the　lack　of　systematic　definition　of　network　user＇s　traffic　behavior,　high　description　dimension　to　network　user＇s　traffic　behavior　and　long　time　to　analyze　single　network　user＇s　traffic　behavior　from　massive　network　data,　a　method　of　establishing　user＇s　traffic　behavior　analysis　system　based　on　network　traffic　monitoring　was　proposed.　First,　a　more　complete　feature　set　based　on　the　characteristic　of　network　traffic　to　describe　network　user＇s　traffic　behavior　was　established.　Second,　a　feature　selection　rule　based　on　the　deviation　distance　was　proposed　to　select　the　optimized　feature　set　for　the　analysis　of　massive　users＇　traffic　behavior　and　locate　abnormal　moment　rapidly.　Finally,　the　single　network　user＇s　traffic　behavior　to　locate　the　abnormal　users　who　produce　abnormal　traffic　behavior　was　analyzed.　Results　show　that　the　system　has　an　excellent　detection　of　the　abnormal　user＇s　traffic　behavior.