The Web Service has been extended to the back-end database. In this paper, we propose a novel method of user behavior analysis in semantic network. We use the weight value to analyze and record user behavior and then check user behavior record with the signatures which are generated by the Intrusion Detection System (IDS). If a user record matches with signatures, the system will pass the record to the Analysis Console for Intrusion Database (ACID) to do more the further processing and then response to user. The ACID does not only help the system administrator to maintain and protect the web service in order to prevent the intruders' attacking but also show the security information. In the current Internet, it is a very complex and insecure environment. Everything can be happened in this environment. In our solution, it can not only successfully solve the Cross-Site Scripting (XSS) attack and SQL Injection attack but also understand user behavior. In the future work, we can use user behavior information to design securer Web service.