controller serves as a bridge between the application plane and the infrastructure layer. On the one hand, the SDN controller exposes diverse programmable services to upper-layer application software via the northbound interface, and network users can flexibly formulate network policies based on actual application scenarios; on the other hand, the SDN controller constructs and maintains a global network view via the southbound interface to control and manage network devices at the infrastructure layer, and inherits the control plane functions. The infrastructure layer is made up of data-forwarding devices such as switches and routers that were abstracted into network devices. The data flow is handled in accordance with the instructions given by the SDN controller, thereby improving network device management efficiency. The physical layer includes control equipment, including field instruments, sensors, and actuators and performs duties such as information interchange between the ICS controller and field equipment. SDN has gotten much attention from people from many areas of life. However, software-defined networks are vulnerable to cyber-attacks in the same way that traditional networks are. As previously said, SDN introduces the SDN controller, which provides unified API services for the application plane and the infrastructure layer, allowing the network to be centralized, programmable, and open. These characteristics, such as permitting mismatched network packets to be submitted to the controller to request forwarding rules, raise security issues for SDN. A network assault is frequently exhibited as anomalous traffic. The term \"abnormal traffic\" refers to network traffic behavior that deviates from the expected typical pattern. Server overload induced by DOS assaults, worms' privileged access, and server attacks will result in anomalous traffic [5]. SDN network security risks primarily target the control plane, with the majority of attacks targeting the network's controller [6]. Malicious controllers, malware, and malicious switches can all put SDN controllers at risk. The controller's security has a direct influence on SDN security since it is the centralized decision-making entity and processing hub of SDN. When aberrant traffic is detected, abnormal traffic detection technology monitors network traffic transmission immediately, sends an alarm, or takes active reaction steps. The  
Figure 1: SDN network architecture diagram  
real-time monitoring of SDN traffic may maintain the security, confidentiality, and integrity of SDN network information while also promoting the development and implementation of SDN technology [5]. As a result, research on intrusion detection systems in the context of SDN offers tremendous theoretical and application value for creating and upgrading SDN technology. [PERSON], [PERSON] et al. [7] proposed the concept of deep learning in 2006. With the continuous improvement in computer computing power and the continuous development of algorithms, deep learning algorithms that require huge computing power have attracted great attention from researchers and enterprises. Traditional detection algorithms based on traffic feature statistics and machine learning perform better when small-scale datasets and feature quantities are small. However, it still relies on the manual judgment and induction of traffic characteristics. Deep learning algorithms can calculate optimal solutions from limited data and do not require expert knowledge to find unknown and new abnormal traffic types. With large-scale datasets and many features, it can also have better performance. We propose an abnormal traffic detection method based on the stacking method and self-attention mechanism (TSMASAM) that combines the self-attention mechanism and ensemble learning to make up for the inability of ensemble learning to learn the associations between data.