Abstract: With the rapid development of Internet technology,a variety of malicious access behavios endanger the information security of network.There is theoretical significance and practical value for network security to identify user’s role and discover malicious access behaviors.Based on Web logs,an IP assisted database was constructed to build IP u-ser’s daily role model.On this basis,the sliding time window technique was introduced,and the dynamic change of time was integrated into user’s role identification.A dynamic identification model of user’s role based on sliding time window was established.Then,analyzing the characteristics of user’s malicious access traffic,the user access traffic and thecharacteristicsof user’s information entropy were weighted to construct an identification model based on multi-characteristics of the user’s malicious access behavior.The model can not only identify explosive and highly persistent malicious access behaviors,but also identify the malicious access behaviors which are small but widely distributed.Finally,the model was implemented by using big data storage and Spark memory computing technology.The experimental results show thatthe user of malicious access behavior can be found by using the proposed model when the network traffic is abnormal,and the user’s role can be identified accurately and efficiently,thus verifying its validity.

Key words: Data mining, Identification of use’s role, Malicious access behavior, Sliding time window, Web users