Abstract: In recent years, the railway Internet ticketing and reservation system has been continuously improved, which brings great convenience to people's travel and increasing ticketing sales at the same time, there exists grabbing tickets, store tickets and other abnormal user behavior. In order to ensure the safe and stable operation of the system and maintain fair and equitable ticketing environment, this article proposed the analysis system framework of large user behavior log based on big data technology. The framework could identify the abnormal ticketing behavior efficiently.