Normal pattern construction is the key step for anomaly detection systems, which surely includes the low-frequency pattern as well as high-frequency pattern.

• 异常检测系统中，在建立正常模式时必须尽可能多得对网络行为进行全面的描述，其中包含出现频率高的模式，也包含低频率的模式。