The statistical methods (like SND ) achieve traffic anomaly
by judging change rate of the traffic parameters, and they adopt the threshold method  to identify unreasonable data values based on historical data.
The experimental results ensure that S3 algorithm perform traffic anomaly
detection with zero false positive.
Zhang, "An empirical evaluation of entropy-based traffic anomaly
detection," in Proc.
 proposed a traffic anomaly
detection algorithm for traffic intersections.
Diot, "Sensitivity of PCA for traffic anomaly
detection," ACM SIGMETRICS Performance Evaluation Review, vol.
Abnormal network traffic requires comprehensive considerations of regionality of the spread and major events together, measuring data mining discriminating algorithm and network application environmental factors collectively to generate adaptive threshold, and realizing the accuracy and effectiveness of network traffic anomaly
Wang, "Network Traffic Anomaly
Detection Based on Self-Similarity using HHT and Wavelet Transform", in Proc.
The company reported a network traffic anomaly
for a few minutes from one of its non-critical machines.