The purpose of data analysis is to compress the data extraction, given its simplicity general description. In this paper, the dynamic attack traffic data, trying to establish in the metropolitan traffic monitoring data, according to the abnormal test, hypothesis testing and other methods of attack traffic identification and reasonable analysis, we found the type of attack traffic and network data from a wide range of macro-and related features, in order to provide a basis for analytical methods and techniques of network security data.