Abstract: Server as an important part of the institutions or organizations usually carries a particular network service, for the security protection, it usually adopts rule-based approaches to detecting attacks according to the specific characters. However, due to the new network attacks emerge in endlessly and network anomaly is difficult to define, anomaly-feature-based detection is more and more difficult to meet the needs of the increasingly complex network environment. To cope with it, we propose the concept of traffic structure stability based on both the inherent stability of normal traffic attributes and the stability of a specific service, and profile the normal network behavior model for the server to detect traffic abnormality. To describe the difference between current traffic structure and the normal profile, we propose a novel visualization measurement method based on Spie Chart. Finally, we implement the system on a mail server and confirm the validity of the model by experiments.