A decomposition method of user packet time-stamp sequence is proposed. Firstly, the method samples the time sequence and utilizes a low-pass filter to extract the burst component based on the different attenuation characteristics of different types of sampled signals. Then, it uses a traversal and matching method to extract the periodic sub-sequence based on Euclid distance between vectors. Finally, it decomposes the encrypted packet sequence into the burst, periodic, and random components. The method does not need to par se the payload of packet, while the periodic component can be used to analyze the user′s routine behavior, and the burst component can be used for burst abnormality detection. Simulation results show that the method can effectively distinguish different components in the sequence.