The invention provides a real-time detection method of network flow anomaly in a communication network, and relates to the technical field of communication networks. The method comprises the following steps: constructing a traffic matrix by using the network flow as a time sequence signal; performing main component decomposition, dividing the network flow into a main component and non main components, wherein the main component expresses main features of the network flow, and the non main components express secondary features of the network flow; performing empirical mode decomposition, dividing the network flow into different intrinsic mode function components through the empirical mode decomposition, wherein each intrinsic mode function component reflects the real hidden information in the network flow, and each intrinsic mode function component is orthogonal to each other; and performing abnormal flow detection according to the main component analysis result and the empirical mode decomposition result. According to the real-time detection method provided by the invention, the main component analysis method is combined with the empirical mode decomposition method, therefore the abnormal components in the network flow can be detected quickly, accurately and effectively, thereby being more comprehensive and better satisfying the actual conditions.