Abstract: Aiming at the security threat detection requirements of new energy power plant network,and the problems of poor adaptive ability,more manual participation and false positives of existing network security anomaly detection me-thods,an adaptive real-time anomaly detection method based on Empirical Mode Decomposition (EMD) was proposed.Firstly,this method characterizes the traffic in the new energy power plant network in dimensions,and establishes the traffic metrics model.Then,the traffic mettrics are decomposed by adaptive EMD,variance calculation,Gauss fitting and threshold determination,and the adaptive anomaly detection and security alarm are realized.Typical attack datasets are used to compare this method and the anomaly detection method based on wavelet transform.The test results show that this method can identify the unknown traffic anomaly accurately,real-time and adaptively.The detection effect is better than the anomaly detection method based on wavelet transform in terms of accuracy and false positives.

Key words: Anomaly detection, Empirical mode decomposition, Network traffic, New energy power plant