A method for identifying risky behavior within a computer network, the method comprising: acquiring user behavior data, the user behavior data comprising a record of network activities conducted by the user in a network in a time period; selecting a specific behavior link from the behavior data by sequentially arranging the network activities within the computer network according to occurrence times; determining a risk coefficient of the specific behavior link in the behavior data, the risk coefficient comprising a numerical value for expressing a degree of rareness of the specific behavior link, comprising determining a historical risk coefficient by: acquiring a total time length for the user from a registration time to a current time; acquiring an actual time length that the user operates the specific behavior link; and smoothing the total time length and the actual time length using logarithmic processing to obtain a smooth total time length and a smooth actual time length, wherein the smooth total time length comprises a logarithm of the total time length and the smooth actual time length comprises a logarithm of the actual time length; and calculating the historical risk coefficient by dividing i) the smooth actual time length plus one, by ii) the smooth total time length plus one; and determining, according to the risk coefficient, whether the specific behavior link is risky. acquiring user behavior data, the user behavior data comprising a record of network activities conducted by the user in a network in a time period; selecting a specific behavior link from the behavior data by sequentially arranging the network activities within the computer network according to occurrence times; determining a risk coefficient of the specific behavior link in the behavior data, the risk coefficient comprising a numerical value for expressing a degree of rareness of the specific behavior link, comprising determining a historical risk coefficient by: acquiring a total time length for the user from a registration time to a current time; acquiring an actual time length that the user operates the specific behavior link; and smoothing the total time length and the actual time length using logarithmic processing to obtain a smooth total time length and a smooth actual time length, wherein the smooth total time length comprises a logarithm of the total time length and the smooth actual time length comprises a logarithm of the actual time length; and calculating the historical risk coefficient by dividing i) the smooth actual time length plus one, by ii) the smooth total time length plus one; and acquiring a total time length for the user from a registration time to a current time; acquiring an actual time length that the user operates the specific behavior link; and smoothing the total time length and the actual time length using logarithmic processing to obtain a smooth total time length and a smooth actual time length, wherein the smooth total time length comprises a logarithm of the total time length and the smooth actual time length comprises a logarithm of the actual time length; and calculating the historical risk coefficient by dividing i) the smooth actual time length plus one, by ii) the smooth total time length plus one; and determining, according to the risk coefficient, whether the specific behavior link is risky.