Method and system for detecting abnormal operation behavior of user

The invention provides a method and a system for detecting an abnormal operation behavior of a user, and belongs to the technical field of information security. The method comprises the following steps: acquiring user operation behavior data, and generating a time sequence; smoothing the time sequence by adopting a local weighted regression algorithm to generate a seasonal component; generating a trend residual sequence by using the time sequence and the seasonal component, and smoothing the trend residual sequence to generate a trend component; calculating the sum of the seasonal component and the trend component as a baseline component; generating a residual sequence by using the time sequence and the baseline component; performing quartile distance measurement on the residual error sequence, and calculating to generate a measurement value; calculating a judgment interval according to the metric value; and identifying an abnormal point of the residual error sequence by utilizing the judgment interval so as