1. A method of network activity detection, comprising the following steps: receiving network flow and generating a first sequence and a second sequence therefrom, each comprising a plurality of consecutive traffic data elements, with at least one traffic data element in the second sequence a succession of the first sequence; creating a first model according to the first sequence, comprising a first development coefficient and a first random factor; generating a first predictive sequence corresponding to the second sequence by substituting the first sequence and the first model into the equation y k + 1 = ( x 0 - b a ) · ⅇ - ak + b a , wherein: X 0 represents the first traffic data element in the first sequence; and y k represents traffic data in predictive sequence; k is a natural number indexing traffic data in predictive sequence; analyzing malicious network activities by comparing the first predictive sequence and the second sequence; and implementing a defense procedure when an analyzing result meets a predetermined condition.