SummaryAlong with the normal network flow, abnormal flow follows, threatening the security and normal use of the computer. Under the impact of the massive network flow, researchers were prompted to study identification methods based on machine learning. Currently, the existing identification methods based on machine learning still have deficiencies, ie, feature redundancy and deficiency in classifier. In order to deal with these problems, this paper proposes an adaptive approach (AEDs) to identify abnormal network flow. The AEDs utilizes the feature extraction algorithm proposed in this paper, which is based on information entropy to filter features and reduce the size of features. Then, a weight construction method based on rough set theory is implemented to construct the weights of given‐case‐based ensemble classifiers, and only the sub‐classifier with weight that is higher than the given threshold will be reserved. On this basis, in order to keep the effectiveness of the classifier, we utilize new flow data to update weights. Moreover, an adaptive detection algorithm is proposed to adaptively monitor the change of entropy of abnormal flow and enable the update of classifier. Finally, experiments have been conducted to illustrate the effectiveness and the feasibility of the approach.