The invention discloses a method and a device for detecting network entity behavior singularity. Through extracting time domain, spatial domain and frequency domain features of network access behaviors of a network entity within a training period, the time domain, spatial domain and frequency domain behaviors are portrayed, and the portraits are regarded as a subsequent network behavior singularity detection basis of the network entity. Compared with the prior art, the method and the device adopt autonomous learning without the need of expert experiences and prior knowledge, are high in detection accuracy rate and low in computational complexity, can synchronously detect and evolve the portraits to ensure the timeliness of detection results, and can support a variety of business applications based on the network traffic detection technology.