As an important subject of the network, the behavior analysis of users is an important means to grasp the network security state and has a significant meaning on potential threat mining and early warning. Considering that users of similar roles in the power intranet have similar behaviors, this paper describes the behavior of individual users based on time sequence and builds behavior relevance among the users by self-learning of the similarity of users' behaviors to achieve abnormality analysis by means of behavior similarity deviation. Meanwhile, changes of users' basic attributes are considered to achieve abnormality early warning judgment. Simulation experiments show that the method can discover abnormal behavior and perform early warning by effectively using the similarity analysis of the behavioral sequences.