# SDN Anomalous Traffic Detection Based on Temporal Convolutional Network
###### Abstract
These methods have many limitations when dealing with increasingly complex and changeable attack methods. Rule-based matching methods usually rely on predefined attack signature databases to identify abnormal behaviors by matching network traffic with known attack patterns. However, as attack methods continue to evolve, new attacks may not conform to established rules, making it difficult for these methods to detect emerging threats in a timely and accurate manner. The statistical analysis method establishes the normal behavior model of network traffic and detects the abnormal situation that deviates from the model. These methods include techniques based on threshold setting, statistical modeling, etc. However, in practical applications, frequent fluctuations in normal flow can lead to high false positive rates and reduce the reliability of detection. With the rapid advancements in deep learning, remarkable progress has been achieved in fields such as image recognition and natural language processing, presenting new opportunities for network anomaly detection. Deep learning models can automatically learn complex features in network traffic data without manually designing feature extractors, and they have stronger adaptability and generalization ability. Currently, deep learning-based network anomaly traffic detection methods can be primarily categorized into those based on convolutional neural network (CNN) [3], recurrent neural network (RNN) [4], and their variants, such as long short-term memory (LSTM) [5] and gated recurrent units (GRU) [6], as well as hybrid models. CNN is capable of extracting complex features from network traffic data without the need for manually designed feature extractors, providing more adaptive and generalizable capabilities. Most CNN models are used to extract spatial features of network traffic data, but they are weak in modeling time series; RNNs and their variants, although able to capture time series dependencies, are prone to the problem of gradient vanishing or gradient explosion when dealing with long sequences, and they have a slow training speed. To overcome these limitations, some studies have proposed hybrid models to improve detection performance by combining the advantages of different models. However, these hybrid models still have some complexity in feature extraction and model training, and there is still room for further improvement in the convergence speed and generalization ability of the models. However, one of the key challenges in anomaly detection, especially in encrypted traffic scenarios, is the effective extraction of representative features from raw network data. Traditional methods that rely on payload inspection become ineffective when traffic is encrypted, necessitating the exploration of alternative feature extraction approaches. In network anomaly detection, features such as packet length distribution, inter-arrival times, flow duration, and statistical properties of network sessions can provide valuable insights even when payload data are unavailable. The effectiveness of any machine learning or deep learning model heavily depends on the quality of these extracted features, as poorly chosen or redundant features may lead to high false positive rates and degraded detection performance. Therefore, advanced feature engineering techniques, including automated feature selection and representation learning through deep models, have become essential for improving detection accuracy and robustness. In recent years, Temporal Convolutional Network (TCN) [7] has emerged in the fields of time series prediction and speech recognition due to its unique sequence modeling capability, which builds a deep network by stacking causal convolutional layers and dilated convolutional layers and combines the efficient parallel computation advantage of convolutional neural networks with the long-range temporal sequence modeling capability of recurrent neural networks.