Timely detection of leak accidents plays an essential role in the safe operation and risk assessment of natural gas pipelines. However, the scarce leak data and complex operating conditions lead to small samples, data imbalance, and problems with confusing operating conditions. The reliance on leak data limits the recognition performance of the artificial intelligence classification method for leakage operating conditions. A leak detection method based on the unsupervised reconstruction of healthy flow data is established to address these problems. First, an unsupervised neural network is established to reconstruct healthy flow data from real natural gas pipelines. And a model update strategy based on active learning is designed to improve the model’s adaptability for time-varying pipelines. Next, a dynamic alarm threshold strategy that accounts for the knowledge of the experience and statistical characteristics of the data segments is suggested to prevent false alarms caused by ambiguous operating conditions. Finally, unlike most recent work that only considers simulated data or laboratory data, this paper conducts a leak case study on an actual natural gas pipeline in service to improve the robustness of the proposed method in the actual operating environment. The findings of this paper can be used as a reference to analyze pipeline behavior analysis based on pipeline flow trend characteristics and early alarm management.