Based on the behavioral data of the students in the process of network test, this paper analyzes the differences between various data from students who have plagiarism and non plagiarism in the test process. The data mainly include the start time, the end time, the time length and the times of answering, the answers and the times of modifing answers from each student’s answer to each question. Finally we found a very high similarity of answers and the time length of answering between two suspected plagiarism students in answering question. Therefore, this paper establishes a model based on the two factors that the two students’ answer time overlap and hamming distance of answers. The experimental results show that the numerical results given by the model can reflect the suspicion of plagiarism and the model has some practical significance.