The invention discloses a network traffic anomaly detection method based on a small amount of annotation data, and the method comprises the steps: carrying out the dimension reduction of a feature vector through employing double auto-encoders, and then carrying out the supervised training through employing a deep neural network; dividing the network traffic into two types of positive samples and negative samples, and finally screening out a part of important samples in unlabeled data and submitting the samples to experts for labeling, increasing the number of labeled samples, iteratively updating an auto-encoder and a classifier, and then employing the trained classifier for detecting network traffic abnormality. According to the invention, a double-auto-encoder architecture is proposed, pure positive and negative samples are used for respectively training the auto-encoders, and the stability of the classifier is improved. Meanwhile, the loss function of the deep neural network is improved, the sample weight is adjusted in a finer-grained manner, the problem of overfitting caused by imbalance of positive and negative samples and small training sets is solved, a new method for calculating the marking value of the unmarked data is provided, the samples with high marking value are selected to be delivered to experts, and the marking cost is reduced.