Research on Network Security Traffic Classification and Threat Detection Model Based on Incremental Learning

According to the data from the Cloudflare 2024 Application Security Report, the current cybersecurity landscape faces numerous challenges. As shown in figure 1 below. The report indicates that nearly 7% of daily traffic is mitigated on average, with more than half attributed to Web Application Firewall (WAF) and bot mitigation measures. Although Distributed Denial of Service (DDoS) attacks remain the primary threat, attacks targeting disclosed vulnerabilities (CVEs) are also on the rise, with some vulnerabilities being exploited just 22 minutes after proof of concept is released. Additionally, about one-third of all traffic is automated, with 93% of bot traffic remaining unauthenticated and potentially malicious. API traffic continues to grow, accounting for as much as 60% of all traffic, yet a quarter of API endpoints are improperly tracked and managed. Furthermore, enterprise sites integrate an average of 47 third-party endpoints, significantly increasing potential security risks. These statistics reveal the inadequacies of traditional defense mechanisms in dealing with advanced threats, particularly 0day vulnerabilities and attacks that bypass the latest WAF strategies. Common automated blocking measures, such as IP blocking triggered by high-risk or large-scale scanning activities, can lead to false positives and inadvertent blocks, thereby increasing the workload for operations and analysis teams. Therefore, developing and implementing more adaptive defense strategies to enhance the system's ability to handle unknown threats and reduce the operational burden on security teams is crucial.