Network user behavior analysis is very important for the security of large organizations' intranet. In order to analyze the behavior of Intranet users, it is necessary to identify the roles of Intranet users. In this paper, a role recognition method based on network flow characteristics is proposed for organizational intranet, which is a specific network space. Firstly, the interactive distribution characteristics of network flow based on information entropy are used to describe the distribution characteristics of different network nodes. Secondly, traffic characteristics are used to analyze the interaction flow between nodes. Finally, based on these feature sets, Stochastic Forest method is applied to recognize the role of intranet. Experiments on real intranet data verify the effectiveness of the proposed method.