# SDN Anomalous Traffic Detection Based on Temporal Convolutional Network
## 5 Conclusions  
With the wide application of SDN centralized architecture, the network security threats it faces show a trend of complexity and concealment. Traditional anomalous traffic detection methods face the bottleneck of high false alarm rate and insufficient generalization capability in a SDN dynamic environment due to their reliance on manual rule design and difficulty in capturing dynamic timing features. To address this challenge, this paper proposes a TCN-based anomalous traffic detection method for SDN, which achieves efficient detection of anomalous traffic through packet length sequence modeling and multi-level timing feature extraction. Compared with existing research, this paper introduces the TCN model into the SDN security domain and utilizes the synergy of its causal convolution and dilation convolution to effectively capture the long-term dependency of traffic data while ensuring the temporal causality. Gradient propagation is optimized through the residual connection mechanism, which significantly improves the training stability and convergence efficiency of the deep network. At the feature design level, it is proposed to take the packet length sequence as the core feature, combined with the five-element group grouping strategy, which reduces the complexity of feature engineering while retaining the key information of traffic dynamic behavior. Experiments based on the publicly available dataset InSDN validation show that the proposed method achieves high detection accuracy on standard datasets. The advantages of a TCN model, such as parallel computation, fast training speed, and relatively small number of model parameters make it highly practical in real-world applications of abnormal network traffic detection. The innovations of this study are mainly reflected in: the parallel computing capability and long-range temporal capture characteristics of the TCN model overcomes the low training efficiency and gradient vanishing problem of the traditional RNN-like models; the lightweight feature design reveals the dynamic behavioral characteristics of sudden flooding of anomalous traffic and low-frequency long connections by a single-dimensional sequence of packet lengths; and the model's advantage of a low number of parameters in resource-constrained scenarios offers feasibility for edge network deployment. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Models** & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\ \hline CNN & 0.8559 & 0.8459 & 0.8411 & 0.8934 \\ LSTM & 0.8619 & 0.8740 & 0.8552 & 0.8543 \\ CNN-LSTM [27] & 0.8773 & 0.8759 & 0.8671 & 0.8678 \\ BiLSTM [29] & 0.8870 & 0.8764 & 0.8756 & 0.8761 \\ TCN(Ours) & 0.9700 & 0.9640 & 0.9691 & 0.9672 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Average detection efficiency of different models on InSDN dataset. However, there are still limitations in the current work. First, the experimental validation in this study is primarily based on the InSDN dataset, which is a simulated dataset. While it effectively demonstrates the feasibility of our approach, further validation using real-world SDN traffic datasets and heterogeneous architectures is required to ensure the model's generalizability. Future research will aim to evaluate the proposed method on diverse datasets, including real-world encrypted traffic scenarios, to enhance its robustness across different SDN environments. Another important limitation is the need for more advanced feature extraction techniques to improve anomaly detection performance, particularly in encrypted traffic scenarios. Traditional packet length sequences, while effective in capturing temporal traffic patterns, may not provide sufficient discriminatory power when dealing with encrypted communication or protocol obfuscation. Feature extraction plays a crucial role in network anomaly detection by enabling the identification of key behavioral patterns without relying on packet payload analysis.