# SDN Anomalous Traffic Detection Based on Temporal Convolutional Network
## 2 Related Work
### Machine Learning-Based Anomaly Traffic Detection Methods  
Machine learning-based detection methods are also widely used in SDN traffic anomaly detection [14; 15; 16], but these methods usually rely on accurate feature engineering support. For example, [PERSON] [17] proposed a Voting-based Non-Kernel Density Estimation (V-NKDE) classifier that combines a voting mechanism with four classical machine learning methods--Naive Bayes, KNN [18], Decision Tree [19], and Extremely Randomized Trees, by classifying the SDN traffic feature data and combining with the voting mechanism for the final result determination. This method can effectively reduce the false alarm rate and the risk of excess, thus improving the accuracy and robustness of traffic anomaly detection. [PERSON] et al. [20] proposed a machine-learning based anomaly detection model, which categorizes packets by analyzing in detail the packet's information, including the source IP, the destination IP, the port number, and other features of the packet. The model utilizes the SDN controller to adjust the forwarding rules in the flow table to block the malicious traffic in time and stop its further propagation. [PERSON] et al. [21] proposed a security model based on the Random Forest algorithm, which identifies the determination of whether an attack is an attack or not by pre-establishing the security policy and the Time To Live (TTL) delay criteria. [PERSON] et al. [22] proposed a blockchain-based intelligent link failure recovery framework for software-defined Internet of Things (SD-IoT) environments. The article innovatively adopts the TOPSIS (optimal solution rule) module for link failure recovery, which integrates multiple quality metrics such as latency, jitter, and bandwidth in alternative path selection, rather than being limited to the shortest path. In addition, in order to enhance the security of IoT systems, the research combines blockchain technology and Artificial Neural Network (ANN) to achieve distributed DDoS attack detection and defense. The blockchain ensures data immutability, while the ANN implements an efficient DDoS attack identification and defense mechanism by analyzing attack patterns in network traffic. The framework not only enhances the efficiency of link recovery but also improves the system's ability to protect against DDoS attacks, providing strong support for the stable operation of SD-IoT. [PERSON] et al. [23] proposed a hybrid deep learning based DDoS attack detection and classification method. This method combines two deep learning models, the Auto-Encoder (AE) and the Multi-Layer Perceptron (MLP). First, feature extraction is performed using AE, which maps the high-dimensional features of network traffic samples to the low-dimensional space through unsupervised learning, from which the most discriminative features are extracted to effectively reduce noise and irrelevant features. Subsequently, the compressed features extracted by AE are input into the MLP model for the classification of DDoS attack types. The experimental results show that the AE-MLP model indicates high accuracy and robustness in the detection and classification of DDoS attacks.