Abstract: This paper puts forward a model which can be used to detect and control illegal activities according to user’s network accessing behavior. The threaten of network security and the waste of network resources can be reduced effectively through building up this active supervision and guard model, which can be combined together with traditional passive preventive defense measure.

Key words: behavior analysis, network monitoring, data mining, statistical analysis, association rules