Traffic　analysis　and　traffic　abnormality　detection　are　emerged　as　an　efficient　way　of　detecting　network　attacks　in　recent　years.　The　existing　approaches　can　be　improved　by　introducing　a　new　model　and　a　new　analysis　method　of　network　user＇s　traffic　behaviors.　The　description　dimensions　to　network　user＇s　traffic　behaviors　in　the　current　approaches　are　high,　resulting　in　high　processing　complexity,　high　delay　in　differentiating　an　individual　user＇s　abnormal　traffic　behavior　from　massive　network　data,　and　low　detection　rate.　To　improve　the　detection　rate　and　efficiency,　we　develop　a　new　method　of　establishing　user＇s　traffic　behavior　analysis　system　based　on　a　new　model　of　network　traffic　monitoring.　First,　we　establish　a　more　complete　feature　set　based　on　the　characteristics　of　network　traffic　to　describe　massive　network　user＇s　behaviors.　Then,　we　define　a　feature　selection　rule　based　on　the　relative　deviation　distance　to　select　the　optimized　feature　set.　We　use　the　selected　feature　set　to　locate　the　abnormality　moment　and　the　users　who　produce　the　abnormal　traffic　behavior.　Finally,　a　traffic　behavior　analysis　method　based　on　prediction　is　developed　to　improve　efficiency　of　the　system.　This　new　method　is　applied　to　evaluate　the　mobile　users　on　mobile　cloud.　The　experimental　results　show　that　the　proposed　method　has　a　higher　detection　rate　and　lower　delay　in　the　analysis　of　abnormal　user＇s　traffic　behavior　than　that　of　the　existing　approaches.　(C)　2014　Elsevier　B.V.　All　rights　reserved.