Method and apparatus for detecting abnormal traffic pattern

A computing device comprising:

• a memory, and
• at least one processor configured to execute instructions of a program loaded in the memory,
• wherein the program includes instructions composed to execute the following operations:
• extracting particular field data from a plurality of collected traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet of the plurality of collected traffic packets, and creating training data with the vector for each traffic packet of the plurality of collected traffic packets,
• training a traffic prediction model with the training data, the traffic prediction model predicting a next input traffic packet from an input traffic packet and whether the next input traffic packet is abnormal, and
• receiving a series of new traffic packets in sequence,
• extracting the particular field data from the new traffic packets, transforming the extracted particular field data to a vector and inputting the vector to the traffic prediction model, and
• predicting a traffic packet to come after the new traffic packet.