Network traffic anomaly detection method and apparatus

An electronic device, comprising:

• a communication interface, a processor, and a memory, wherein:
• the processor is configured to invoke instructions stored in the memory, and to execute the instructions to:
• obtain net flows generated by a network monitoring node in a set period of time via the communication interface;
• aggregate, for any one of attributes of the net flows, the net flows at a set interval of time according to the any one of the attributes to generate N number of time sequences for the any one of the attributes;
• determine N number of samples to be detected, corresponding to the net flows according to the N number of time sequences corresponding respectively to each of the attributes, wherein each sample to be detected comprises time sequences corresponding to respective attributes in a same aggregation period of time;
• calculate, for a first time sequence corresponding to a first attribute of a first sample to be detected, dissimilarities in angle between the first time sequence, and (N−1) number of second time sequences corresponding to the first attribute of the other (N−1) number of samples to be detected, respectively, wherein the first sample to be detected is any one of the N number of samples to be detected, the first attribute is any one of the attributes of the net flows, and each of the dissimilarities in angle is a sine value of an angle between a vector of the first time sequence and a vector of a corresponding second time sequence;
• and determine a first detection result for the first time sequence according to (N−1) number of dissimilarities in angle corresponding to the first time sequence;
• and
• determine whether each sample to be detected is an abnormal data flow, according to a detection result for each time sequence in each sample to be detected.