With the explosive growth of mobile terminal access to the Network and the shortage of IPv4, the Network Address Translation (NAT) technology has become more and more widely used. The technology not only provides users with convenient access to the Internet, but also brings trouble to network operators and regulatory authorities. This system NAT detection using NetFlow data, is often used for monitoring and forensics analysis in large networks. In the paper, in order to detect NAT devices, an Out-in Activity Degree method based on network behavior is proposed. Our approach works completely passively and is based on NetFlow data only. Our approach gets accuracy of 91.2 % in real large-scale network for a long time.