摘要：

随着网络环境的不断演进以及互联网应用的不断涌现, 基于先前流量训练的机器学习分类器对新样本空间的适用性逐渐变弱, 导致分类模型的识别能力下降, 从而无法满足日益增长的网络业务和网络安全需求。若根据经验通过人工更新分类器, 将会耗费大量精力, 且难以保证新分类器的泛化性能。与此同时, 新数据的不断涌入给平衡模型训练精度与计算资源存储带来了严峻的挑战。为此, 提出一种采用空间优化技术的增量学习策略, 以实现高效的网络流量分类。首先, 通过优化新旧流量样本的空间分布, 让新旧各类别所在的簇保持最小间隔, 避免新旧任务因共享同一个特征空间而产生分布冲突; 然后, 在优化后的特征空间内, 利用少量旧数据样本进行回放, 并结合知识蒸馏技术来维持原始模型参数的稳定性, 仅对模型的扩展部分进行调整, 以最小的代价更新分类器。在USTC-TFC2016数据集上的实验结果表明, 与其他方法相比, 该方法在模型精度、资源消耗与性能方面均表现出较高的稳定性与有效性。

关键词: 网络流量, 增量学习, 知识蒸馏, 灾难性遗忘, 深度学习

Abstract:

With the continuous evolution of network environments and the constant emergence of Internet applications, the applicability of machine learning classifiers trained on previous traffic data to new sample spaces gradually weakens. This leads to a decline in the recognition capability of classification models; thus, these models are ineffective in meeting the ever-increasing demands of network services and security. If the classifier is manually updated based on experience, it consumes a significant amount of effort, and it is difficult to ensure the generalization performance of the new classifier. Moreover, the continuous influx of new data poses severe challenges in balancing model training accuracy with the storage of computational resources. To address this issue, an incremental learning strategy employing spatial optimization techniques is proposed to achieve efficient network traffic classification. First, by optimizing the spatial distribution of old and new traffic samples, clusters of different categories (both old and new) are maintained with minimum intervals to avoid distribution conflicts arising from old and new tasks shared feature space. Within the optimized feature space, a small number of old data samples are replayed, and knowledge distillation techniques were utilized to maintain the stability of the original model parameters. Only the extended parts of the model are adjusted to update the classifier at minimal cost. Experimental results on the USTC-TFC2016 dataset demonstrate that, compared with other methods, this approach exhibits higher stability and effectiveness in terms of model accuracy, resource consumption, and performance.

Key words: network traffic, incremental learning, knowledge distillation, catastrophic forgetting, deep learning