The invention provides a large-scale network service system abnormal behavior detection method and aims to solve the technical problem that a system abnormality agile sensing model provides theoretical support for the system abnormality problem caused by aggregation when sensing the lawful behavior of a user rapidly but does not provide specific implementation and achieve the technical effect that a large-scale network service system abnormal behavior agile sensing method is applied to an actual system. The large-scale network service system abnormal behavior detection method has the advantage that technical support is provided for applying the large-scale network service system abnormal behavior agile sensing method to the actual system.