## 2 Related Works
[22] developed an anomaly detection method for large networks. The algorithm first uses a Kalman filter to filter out \"normal\" traffic and judges by comparing the predicted traffic matrix with the actual traffic matrix. Then, detect whether there is any abnormality in the remaining filtering process. [PERSON]. [22] here explains how any anomaly detection method can be viewed as a problem in statistical hypothesis testing. [PERSON]. [23] believed that if the joint distribution of multi-dimensional data can be effectively expressed, one can try to estimate the tail probability of each point, and then the abnormal situation can be well evaluated. To date, [PERSON]. [23] proposed a copula-based anomaly detection algorithm. The copula is a statistical probability function for efficiently modeling dependencies among multiple random variables. [PERSON]. [23] used a non-parametric method, obtains empirical copula through empirical cumulative distribution (Empirical CDF), and then estimates the tail probability of joint distribution of all dimensions through empirical copula. The advantage of the algorithm based on data feature statistics is that it is simple to implement and can also identify abnormal traffic in unknown networks, but it is prone to misjudgment. Algorithms based on machine learning have a strong learning ability and can effectively deal with unknown abnormal network traffic. [PERSON]. [24] proposed a 5G-oriented network defense architecture. To this end, [PERSON]. [24] used deep learning techniques to analyze network traffic by extracting features from it. In addition, the architecture allows automatic the adjustment of the configuration of the network fabric to manage traffic fluctuations. Experiments show that the method can adaptively adjust the anomaly detection system and optimize resource consumption. [PERSON]. [25] proposed an anomaly-based NIDS implemented using deep learning techniques. The method demonstrates the ability and adaptability to infer partial knowledge from incomplete data. With the advent of the Internet of Things, the need to process streaming data in real-time has become critical. To this end, [PERSON]. [26] proposed a hybrid data processing model using GWO and CNN for anomaly detection. In order to increase the learning ability of the model, both GWO and CNN learning methods have been enhanced; for the first, the generative ability to explore, exploit and initialize the population is improved; for the second, the dropout function is improved. Ref. [26] first used GWO for feature selection to obtain the best trade-off between two objectives, i.e., reducing the error rate and minimizing the feature set. Then, [PERSON]. [26] used CNN for network anomaly classification. In Ref. [27], in order to deal with the security issues brought by SDN, a deep neural network model was constructed and trained using the NSL-KDD dataset. During the training process, only six basic features among the forty-one features were selected for training. However, the dataset selected by this method is not in the SDN environment and is not necessarily suitable for the SDN environment. To improve the reliability of SDN, Ref. [28] proposed a hybrid deep learning-based anomaly detection scheme for suspicious flow detection in social multimedia environments. The scheme consists of an anomaly detection module and an end-to-end data transfer module. The anomaly detection module utilizes a modified, restricted Boltzmann machine and a gradient descent-based support vector machine to detect anomalous traffic. The end-to-end data transmission module is designed to meet the strict QoS requirements of SDN. Since existing anomaly detection solutions all require a large number of datasets for offline training, Ref. [29] proposed a neural network-based anomaly detection system with dynamically updatable training models--Griffin, which utilizes an ensemble of autoencoders from normal and abnormal traffic which is jointly screened in the traffic, and the autoencoder, which is updated according to the mean square error.