# SDN Anomalous Traffic Detection Based on Temporal Convolutional Network
## 4 Experiments and Analysis
### Experiment Result  
Figure 6a shows the variation trend of the model's accuracy in the training process under different learning rates (e.g., 0.01, 0.03, 0.001, and 0.002). With the increase in training epochs, the accuracy of the model gradually becomes stable. When the learning rate is set to 0.001, the accuracy of the model is the highest after the final convergence. Figure 6b further analyzes the impact of batch size on model checking performance. On InSDN dataset, the experiment compared the detection accuracy of models with different batch sizes (such as 16, 32, 64). The results showed that when the batch size was 32, the detection accuracy of TCN model in different training stages was the best, which not only ensured good generalization ability, but also took into account the training stability. As can be seen from Figure 6, when the number of training rounds reaches 10, the accuracy rate of the model tends to be stable. Therefore, the number of single training samples used in the method proposed in this paper is 32, the epoch is 10, and the learning rate is 0.001. In addition, by referring to the previous literature and conducting experimental verification, the model can maintain good stability during training when the dropout is set to 0.2. The experimental results show that the anomalous traffic detection method based on the bidirectional TCN model exhibits high classification performance in the binary classification task (normal and malicious traffic). In the model performance evaluation, the confusion matrix can directly show the number of true cases, false positive cases, true negative cases, and false negative cases, which can clearly understand the performance  
Figure 6: The selection of parameters for TCN: (**a**) Accuracy at different learning rates on InSDN. (**b**) Accuracy at different batch sizes on InSDN. of the model for each category. According to the confusion matrix generated from the experimental results (shown in Figure 7), the detection accuracy is 96.36% for normal traffic (benign) and 97.97% for malicious traffic (malicious). The confusion matrix results show that the model has a false detection rate of 3.64% for normal traffic and 2.03% for malicious traffic, indicating that the model has a low false alarm rate and leakage rate. By comprehensively analyzing the classification indexes, the model performs more stably in detecting malicious traffic and effectively distinguishes normal traffic from abnormal traffic. Considering the generalization ability of the model, experiments are carried out on different public network traffic datasets. As shown in Table 1, On InSDN dataset, the precision rate of normal traffic (benign) is 98.15%, the recall rate is 96.36%, and the F1-score is 97.25%; the precision rate of malicious traffic (malicious) is 96.03%, the recall rate is 97.97%, and the F1-score is 96.99%. These results show that the model's performance is more balanced in both normal and malicious traffic tasks and can accurately detect abnormal traffic and effectively reduce the false alarm rate. However, in the CICIDS 2017 dataset, due to the complexity of traffic and attack mode, the index of malicious traffic detection in the model is slightly lower. The USTC-TFC2016 dataset is between the two, and the overall performance is more balanced. In Table 2, we compare and analyze the accuracy of five models in benign and malicious sample classification tasks, aiming to evaluate the performance of each model. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Datasets** & **Metrics** & **Benign** & **Malicious** \\ \hline \multirow{3}{*}{InSDN} & precision & 0.9815 & 0.9603 \\  & recall & 0.9636 & 0.9797 \\  & F1-score & 0.9725 & 0.9699 \\ \hline \multirow{3}{*}{CICIDS 2017} & precision & 0.9750 & 0.9520 \\  & recall & 0.9582 & 0.9630 \\  & F1-score & 0.9665 & 0.9575 \\ \hline \multirow{3}{*}{USTC-TFC2016} & precision & 0.9780 & 0.9582 \\  & recall & 0.9626 & 0.9690 \\ \cline{1-1}  & F1-score & 0.971 & 0.9635 \\ \hline \hline \end{tabular}
\end{table}