A user behavior analysis (UBA) method, and a related device and system are provided. The method is applied to a UBA system including at least one UBA cloud server. The method includes: receiving, by a UBA cloud server, a network content identifier reported by a first UBA subnode, where the network content identifier cannot be identified by the first UBA subnode; acquiring network content corresponding to the network content identifier; extracting a keyword from the network content; updating a behavior knowledge base by using the extracted keyword; and delivering, by the UBA cloud server, the updated behavior knowledge base or updated content of the behavior knowledge base to a UBA subnode set, where the UBA subnode set at least includes the first UBA subnode and a second UBA subnode. The UBA cloud server and the UBA subnodes are associated with a telecommunication network.