The characteristic of anomaly traffics is that it breaks out without any omen and can destroy networks and computers in a short time ( for instance , the outburst of traffic behavior caused by specific attack programs or worm burst ) . therefore , to detect anomaly rapidly and accurately is one of the precondition of ensuring the efficient network operation and detection of anomalous traffic has become the attractive and valuable subject in the present academic and industrial circles 异常流量的特点是发作突然,先兆特征未知,可以在短时间内给网络或网络上的计算机带来极大的危害(例如由特定的攻击程序或蠕虫爆发所引起的突发流量行为) ,因此准确、快速地检测网络流量的异常行为,并做出合理的响应是保证网络有效运行的前提之一,也是目前学术界和工业界共同关注的前沿课题之一。