Focus　on　the　difficulty　of　large-scale　network　traffic　monitoring　and　analysis,　this　paper　proposed　the　concepts　of　Group　Behavior　Flow　model　to　aggregate　traffic　packets　and　perform　abnormal　behavior　detection.　Based　on　the　flow　model　the　pivotal　traffic　metrics　can　be　extracted　while　the　number　of　flow　records　are　reduced　significantly.　Secondly,　we　employ　the　graph　model　to　capture　the　traffic　feature　distribution　between　different　group　users.　And　optical　flow　analysis　methods　are　proposed　to　extract　the　dynamic　behavior　changing　features　between　different　groups　and　achieve　the　goal　of　abnormal　behavior　detection.　The　experimental　results　based　on　actual　traffic　traces　show　that　the　methods　proposed　in　this　paper　can　capture　the　traffic　features　effectually　in　the　current　10　Gbps　network　environment,　and　achieve　the　goal　of　abnormal　behavior　detection　and　abnormal　source　location,　which　is　very　important　for　traffic　management.　©　ICST　Institute　for　Computer　Sciences,　Social　Informatics　and　Telecommunications　Engineering　2018.