Network Traffic Classification Method Fused with Flow Energy Model.

Abnormal network traffic detection is a key cybersecurity technology that assists in identifying and preventing malicious network attacks. Existing methods for detecting abnormal network traffic typically rely on complex machine learning models and a large amount of labeled data. Consequently, these methods are challenging to apply to different scenarios without retraining the model and cannot effectively handle large-scale, ongoing network attacks in real-time. To address these issues, this paper proposes a classification method based on a network flow energy model. It utilizes a reverse statistical physics model to learn target traffic features in the network, allowing it to be based on macroscopic real observations or real data without the need for manual labeling. Subsequently, the paper combines the concept of the energy model to construct a network traffic recognition model. This model judges whether a sample conforms to the main statistical distribution. Specifically, the method describes individual behavior characteristics and interaction features between traffic packets through the local field and coupling field in the energy model. By combining these two features, the method calculates the sample' s energy. If the energy is below a threshold, the sample aligns with the main distribution, indicating normal data; otherwise, it is considered abnormal data. As this method does not rely on manual labeling, it can adapt to various network environments without the need for repetitive training. This addresses current issues in traffic abnormality detection methods, which struggle to adapt to different scenarios and require extensive labeling. To evaluate the effectiveness of this method, the paper validates it using the Kitsune-2018 and CTU-13 datasets. Experimental results demonstrate that the proposed method achieves good classification performance and overall effectiveness in network traffic classification tasks. This further indicates its accuracy in performing network flow classification tasks and its adaptability to changing scenarios. [ABSTRACT FROM AUTHOR]