The invention discloses a multi-element scene-oriented network unit abnormal flow detection method, which belongs to the technical field of computer networks, and comprises the following steps of: calculating multi-dimensional flow behavior characteristics in a multi-element scene based on super-large-scale
network communication metadata in a
complex network environment, evaluating the historical behavior fluctuation condition of each network unit, and calculating the abnormal flow of each network unit. The departure degree of current data and historical fluctuation is compared, comprehensive scoring is carried out in combination with the abnormal degree of the multi-dimensional
label, and abnormal traffic behavior recommendation is achieved; the
system comprises five steps of network flow meta-datamation, multi-element scene division, statistical
feature extraction, abnormal index calculation and comprehensive scoring. Based on large-scale network traffic
metadata, a plurality of behavior scenes are set, the fluctuation condition of a characteristic curve is calculated according to historical traffic behavior data of a network unit, historical behavior habits of different individuals are observed, a multi-dimensional anomaly
label system is constructed, and finally, the traffic anomaly condition of the network unit is comprehensively evaluated. And discovery and early warning of abnormal network behaviors are realized.