Abstract: Abnormal network traffic detection is a key cybersecurity technology that assists in identifying and preventing malicious network attacks. Existing methods for detecting abnormal network traffic typically rely on complex machine learning models and a large amount of labeled data. Consequently, these methods are challenging to apply to different scenarios without retraining the model and cannot effectively handle large-scale, ongoing network attacks in real-time. To address these issues, this paper proposes a classification method based on a network flow energy model. It utilizes a reverse statistical physics model to learn target traffic features in the network, allowing it to be based on macroscopic real observations or real data without the need for manual labeling. Subsequently, the paper combines the concept of the energy model to construct a network traffic recognition model. This model judges whether a sample conforms to the main statistical distribution. Specifically, the method describes individual behavior characteristics and interaction features between traffic packets through the local field and coupling field in the energy model. By combining these two features, the method calculates the sample’s energy. If the energy is below a threshold, the sample aligns with the main distribution, indicating normal data; otherwise, it is considered abnormal data. As this method does not rely on manual labeling, it can adapt to various network environments without the need for repetitive training. This addresses current issues in traffic abnormality detection methods, which struggle to adapt to different scenarios and require extensive labeling. To evaluate the effectiveness of this method, the paper validates it using the Kitsune-2018 and CTU-13 datasets. Experimental results demonstrate that the proposed method achieves good classification performance and overall effectiveness in network traffic classification tasks. This further indicates its accuracy in performing network flow classification tasks and its adaptability to changing scenarios.

Key words: network flow classification, network flow, flow-based classifier, energy model, reverse statistical physics model

摘要： 网络流量异常检测是一种可以协助识别和预防恶意网络攻击的关键网络安全技术。现有的网络流量异常检测方法通常依赖于复杂的机器学习模型和大量的标记数据，因此，这些方法在不重新训练模型的情况下难以应用于不同场景，无法实时有效地处理大规模的、持续发生的网络攻击。针对这些问题，提出了一种基于网络流能量模型的分类方法，使用逆统计物理学模型学习网络中目标流量特征，能够以宏观的现实观测或现实数据为基础，不再依赖人工标注。结合能量模型的概念构建网络流量识别模型，通过该模型判断样本是否与主体统计分部相符。具体来讲，通过能量模型中的局部场和耦合场分别描述流量包之间的个体行为特征以及相互行为特征。结合以上两种特征来计算样本的能量，若能量小于或等于阈值，则样本与主体分布相符，说明该样本为正常数据，否则判断为异常数据。由于该方法不依赖于人工标注，能够适应多种网络环境，且无须重复训练，进而能够解决当前流量异常检测方法无法适应不同场景，以及需要大量标注等问题。为了评估该方法的有效性，使用数据集Kitsune-2018和CTU-13对方法进行验证。实验结果表明，该方法在网络流量分类任务中能够取得较好的分类效果和性能表现，进一步说明该方法能够准确地执行网络流分类任务并且能够适应场景变化。

关键词: 流量分类, 网络流量, 流分类器, 能量模型, 逆统计物理学模型