Abnormal behavior detection method and device

The invention provides an abnormal behavior detection method and device, and the method comprises the steps: 1), obtaining original data corresponding to a to-be-detected user, and the original data comprising the equipment attribute information, risk control data and business data of the user; 2) based on the stationary sequence corresponding to the original data, identifying a first abnormal user in the to-be-detected users by utilizing an ARIMA model; 3) obtaining a second abnormal user in the to-be-detected user through a clustering algorithm based on the original data, and 4) carrying outrisk rating on a first abnormal user and the second abnormal user through a density and grid clustering algorithm to obtain the to-be-detected user with the high abnormal risk. By applying the embodiment of the invention, the safety performance is improved. 本发明提供了一种异常行为检测方法及装置，所述方法包括：1)、获取对应于待检测用户的原始数据，其中，所述原始数据包括：用户的设备属性信息、风控数据、业务数据；2)、基于所述原始数据对应的平稳序列，利用ARIMA模型识别出待检测用户中的第一异常用户；3)、基于所述原始数据，利用聚类算法，获取待检测用户中的第二异常用户；4)、利用密度和