机器学习分类算法是异常流量检测的核心技术。大数据使机器学习进入了数据驱动的时代。海量的网络流量数据与图像、语音、文本数据差别很大，流量数据多样性差异化，给机器学习分类算法带来了新的挑战，适用于图像、语音等数据的算法在流量数据上效果欠佳。针对这些挑战，本项目首先提出半监督学习方法对无标签流量数据进行标记，建立双映射迁移学习模型充分利用历史有标签流量数据，构建集成dropout生成对抗网络产生逼真的模拟流量，解决不平衡问题；然后设计新型的基于自步学习的深度神经网络流量去噪算法，建立带自注意力机制的表征学习模型提取鲁棒的特征，提升对抗噪声的鲁棒性；同时，提出基于平衡损失的识别未知类别流量的增量式学习算法,以及基于正则化损失知识蒸馏技术使算法动态自适应，加快检测速度。我们把流量分类方法应用于异常检测，进行细粒度化异常流量分析。本课题为网络入侵检测提供新的理论和技术支持，为机器学习的发展提供新思路。

The classification algorithm of machine learning is the core technique in network traffic anomaly detection. With the advent of big data, machine learning has entered the era of data-driven. Mass network traffic data is very different from image, voice and text data and shows the feature of diversity and differentiation: imbalanced, noisy, complex and various. These bring new challenges to machine learning classification algorithms. The algorithms suitable for image, voice and text data perform not well enough in network traffic data. To solve the imbalance problem, this project first proposes a semi-supervised learning method to mark the unlabeled traffic data, establishes a dual mapping transfer learning model to make full use of historical tagged traffic data, builds a generative adversarial network with the ensemble idea and the dropout technique to generate realistic simulation traffic data. Then, to improve the robustness against noise, a novel traffic denoising algorithm based on self-paced learning with deep neural networks is designed and the self-attention mechanism is incorporated into representation learning to extract robust features. Meanwhile, on one hand, to speed up the detection process, we adopt the incremental learning algorithm for identification unknown class traffic with balanced loss. On the other hand, to make the algorithm dynamic adaptive, knowledge distillation based on regularized loss is proposed. In addition, we apply the traffic classification method to anomaly detection and do fine-grained abnormal traffic analysis. This project provides the new theoretical and technical support for network intrusion detection and brings new ideas for the development of machine learning.