Disclosed are a risk behavior recognition method and system, a storage medium, and a device, which relate to the field of big data risk control. The method comprises the following steps: extracting, according to behavior log data, each specific behavior of each user in a set user set, and obtaining a specific behavior sequence of each user; using a pre-set strong rule to find high-risk suspected users in the set user set, recording the high-risk suspected users as a first user set, and recording the remaining users in the set user set as a second user set; setting specific behavior pairs, and calculating a first transition probability and a second transition probability; for the same specific behavior pair, determining whether the difference between the first transition probability and the second transition probability is within a pre-set range, and if not, recording the specific behavior pair as a risk specific behavior pair; and calculating the information entropy of each group of risk specific behavior pairs, and determining whether a user is a suspected user according to the size of the information entropy. The risk behavior recognition method in the present invention can find malicious users whose cheating characteristics are not obvious.