# SDN Anomalous Traffic Detection Based on Temporal Convolutional Network
## 4 Experiments and Analysis  
### Dataset  
To verify the effectiveness of the proposed method, this paper uses the different public datasets for experiments. Considering the need for data balance, we applied oversampling techniques to ensure a more balanced distribution between normal and abnormal traffic in the datasets. This approach helps to mitigate class imbalance and enhances the model's ability to generalize. InSDN dataset [33]. The InSDN dataset released by UCD ASEADOS Lab in 2020, is the first benchmark dataset built specifically for SDN intrusion detection scenarios, which makes up for the shortcomings of the traditional intrusion detection dataset in terms of the dynamics of the SDN architecture and the simulation of control plane attacks. The dataset is generated based on a virtualized experimental environment that simulates an SDN topology containing OpenDaylight controllers, Open vSwitch switches, and multiple hosts. Network traffic is constructed through the Mininet tool, and seven types of typical attacks are simulated using Scapy, including DDoS, port scanning, ARP Spoofing, Flow Table Flooding, ICMP Flooding, TCP SYN Flooding, and Controller Resource Exhaustion Attacks, which cover attack vectors in the SDN data plane, control plane, and application plane. The data collection is stored in PCAP format, in which normal traffic accounts for about 20% and abnormal traffic accounts for about 80%. Each traffic sample is grouped by five-tuple and labeled with the attack type and timestamp, and the labeling process is cross-validated by network security experts to ensure reliability. These samples represent aggregated flows, which consist of multiple packets between the same source and destination within a specified time window, rather than individual packets. Specifically, the labeling was initially performed by automated scripts that categorized traffic based on predefined attack signatures and behavioral patterns. This automated labeling was then reviewed by a panel of cybersecurity professionals, including researchers from the UCD ASEADOS Lab and external domain experts specializing in SDN security and intrusion detection. In cases where discrepancies or uncertainties arose, a consensus-based approach was adopted: multiple experts independently reviewed the mislabeled or ambiguous instances, and a final classification decision was made based on majority agreement. The dataset labels flows based on the presence of malicious activity during their lifetime. If any part of a flow contains attack traffic (e.g., a DDoS attack initiated mid-flow), the entire flow is labeled as malicious. Overlapping flows (e.g., simultaneous connections with the same five-tuple) are likely distinguished by timestamps or unique flow identifiers to ensure granularity. Additionally, we have conducted experiments using approximately 20% normal traffic and 20% abnormal traffic to evaluate our model's performance in a more balanced setting. * CICIDS 2017 Dataset [34]. The CICIDS 2017 dataset, developed by the University of New Brunswick, is a widely used dataset for intrusion detection research. It simulates real-world normal and attack traffic using a realistic testbed environment with various attack types, including DoS, brute-force attacks, botnets, web-based attacks, and infiltration. The dataset captures both network flow-based and raw packet-based data, providing rich feature sets for machine learning-based intrusion detection models. * USTC-TFC2016 [35]. The USTC-TFC2016 dataset developed by the University of Science and Technology of China (USTC) is a benchmark for encrypted traffic classification. It consists of various types of encrypted traffic, including legitimate applications such as Skype, WeChat, and BitTorrent, as well as malicious traffic from botnets and malware. The dataset includes both flow-based statistical features and raw packet data, enabling research in machine learning-based encrypted traffic classification.