The invention provides an abnormal user retrieval system based on a data stream, which uses an original SimCard algorithm monitor 'user-interest' data flows (such as call network, traffic network, social network friends, etc.) in real time, and the abnormal users are fed back according to the seeds given by the users, and the abnormal users are filtered out according to the conditions given in advance. The system includes a data stream sampling subsystem, similar user querying subsystem and abnormal user filtering subsystem. The invention can be used for dynamic sampling of data streams, and estimating the cardinal number of a certain user interest set and estimating an intersection size of a set of interests between two users; It can also be used to estimate the degree of similarity between two users; Similar exception user retrieval can also be performed according to a given seed exception user, and the like.