In real-time operation state analysis of power grid, in order to meet the requirements of real-time analysis and processing of large-scale real-time data, such as real-time electricity consumption data, and provide fast and accurate data analysis support for power grid operation decision, the system architecture for large-scale data analysis and processing based on stream computing and memory computing was proposed. The Discrete Fourier Transform (DFT) was used to construct abnormal electricity behavior evaluation index based on the real-time electricity consumption data of the users by time window. The K-Means clustering algorithm was used to classify the users' electricity behavior based on the characteristics of user electricity behavior constructed by sampling statistical analysis. The accuracy of the proposed evaluation indicators of abnormal behavior and user electricity behavior was verified by the experimental data extracted from the actual business system. At the same time, compared with the traditional data processing strategy, the system architecture combined with stream computing and memory computing has good performance in large-scale data analysis and processing.