# SDN Anomalous Traffic Detection Based on Temporal Convolutional Network
## 3 Proposed Method
### TCN Model  
TCN is a deep learning model specialized in processing time series data. The core idea of TCN is to capture long-term dependencies in time series by CNN. Compared with the traditional RNN, TCN has better parallel computing capability and fewer parameters, thus showing higher efficiency and better performance in processing long sequence data. The structure of TCN mainly consists of an input layer, multiple residual blocks and an output layer. Each residual block contains multiple convolutional layers, which enhance the model's learning capability through residual connection. In addition, TCN introduces dilated convolution, which expands the sensory field by inserting voids in the convolution kernel to capture longer temporal dependencies without increasing the computational effort. The structure of the TCN convolutional network is shown in Figure 4, which ensures that the future information in the time series does not affect the current prediction by adopting convolutional method with interval sampling, thus maintaining the principle of causality in time series analysis. Compared with traditional convolutional methods, TCN is able to span a certain step size when performing convolutional operations, so that a wider perceptual range and capture dependencies at more distant time points can be obtained even if the output size remains constant. This design allows TCN to be more efficient in analyzing time-series data and to better understand and predict long-term dependency patterns. In Figure 5, we present the TCN model for SDN anomalous traffic detection. The model is designed to efficiently handle long time series data, and the main structure includes residual blocks and dilated causal convolutional layers. The model structure in the figure employs multiple layers of residual blocks to ensure that the training of the deep network is more stable and easy to optimize. The inputs in the figure are processed through three residual modules, and the residual blocks are jump-connected after each layer of convolution to avoid the common problem of gradient vanishing in deep networks and to speed up convergence. Dilated causal convolution allows the network to capture more complex temporal dependencies by expanding the sensory field, while causality ensures that the output depends only on the current moment and previous moment data. Finally,  
Figure 3: The process of traffic preprocessing. the output of the model is processed through a \(1\times 1\) convolutional layer to further map the features to the desired output. The causal convolutional layer is the basis of the TCN model, which employs causal convolutional operations to ensure that only information from previous moments is used in predicting the output at the current moment, thus maintaining the sequential nature of the time series. The causal convolutional layer extracts local features in the sequence through convolutional operations of the convolution kernel with the input sequence and passes these local features to the next layer. The output of the causal convolutional layer can be expressed as  
\[y_{t}=\sigma(W*x_{t}+b) \tag{1}\]  
where \(y_{t}\) is the output of the causal convolutional layer at moment \(t\), \(\sigma\) is the activation function, \(W\) is the convolutional kernel weight, \(b\) is the bias term, \(*\) denotes the convolution operation, and \(x_{t}\) is the value of the input sequence at moment \(t\). The activation function used in this paper is _ReLU_, which is a non-saturated activation function that is unsaturated at positive numbers and hard saturated at negative numbers. Since there are only linear  
Figure 4: TCN convolutional network architecture. Figure 5: Improved TCN structure. The left part indicates that the TCN is composed of three residual blocks; the right part indicates the details of each residual block. relations in the \(ReLU\) function, it converges faster and is a commonly used activation function in CNNs. The function of \(ReLU\) is shown in Equation (2). \[ReLU(x)=