Abstract: As the network environment continues to evolve and internet applications emerge, machine learning classifiers trained on previous traffic data are becoming increasingly less adaptable to new sample spaces. This leads to a decline in the identification capabilities of classification models, which cannot meet the growing demands of network services and network security. Manually updating classifiers based on experience requires a significant amount of effort and does not guarantee the generalization performance of the new classifiers. At the same time, the continuous influx of new data poses a severe challenge to balancing model training accuracy with computational resource storage. Considering this, this paper innovatively proposes an incremental learning strategy spatial optimization technique to achieve efficient network traffic classification. First, by optimizing the spatial distribution of new and old traffic samples, clusters of new and old categories are kept at a minimum interval, avoiding distribution conflicts between new and old tasks due to sharing the same feature space. Then, within the optimized feature space, a small amount of old data samples are replayed, and knowledge distillation technology is combined to maintain the stability of the original model parameters, adjusting only the extended part of the model to update the classifier at the minimum cost. Experiments on the USTC-TFC2016 dataset show that, compared with other methods, the proposed method in this paper demonstrates higher stability and effectiveness in terms of model accuracy, resource consumption, performance, and ablation experiments.

摘要： 随着网络环境的不断演进以及互联网应用的不断涌现，基于先前流量训练的机器学习分类器对新样本空间的适用性逐渐变弱，导致分类模型的识别能力下降，从而无法满足日益增长的网络业务和网络安全需求。若根据经验人工更新分类器需要耗费大量精力，且难以保证新分类器的泛化性能。与此同时，新数据的不断涌入对平衡模型训练精度与计算资源存储带来了严峻的挑战。基于此，本文创新性地提出一种采用空间优化技术的增量学习策略，以实现高效的网络流量分类。首先，通过优化新旧流量样本的空间分布，让新旧各类别所在的簇保持最小间隔，避免新旧任务因共享同一个特征空间而产生分布冲突。然后，在优化后的特征空间内，利用少量旧数据样本进行回放，并结合知识蒸馏技术来维持原始模型参数的稳定性，仅对模型的扩展部分进行调整，以最小的代价更新分类器。在USTC-TFC2016数据集上的实验表明，与其他方法相比，本文所提方法在模型精度、资源消耗与性能以及消融实验方面，均表现出较高的稳定性与有效性。