# SDN Anomalous Traffic Detection Based on Temporal Convolutional Network
###### Abstract  
The wide application of software-defined network (SDN) architecture, combined with its centralized control characteristics, have exacerbated the potential risk of network attacks, and the traditional anomaly traffic detection methods are facing the challenges of high false alarm rate and insufficient generalization ability due to the reliance on manual rule design and the difficulty in capturing dynamic temporal features. In response to these challenges, we propose a Temporal Convolutional Network (TCN)-based anomalous traffic detection method for SDN. Taking the packet length sequence as the core feature, the long-term temporal dependency in the traffic data is effectively captured by causal convolution and dilation convolution operations of the TCN model, combined with the residual connection mechanism to optimize the gradient propagation and improve the stability of the model training. The experiments validate the model performance based on the public InSDN dataset, and the results show that the method achieves high accuracy in the binary classification task of normal and malicious traffic and improves its detection accuracy by about 5% compared with traditional statistical methods and mainstream deep learning models. a _Applied sciences_  
20  
plane. In Software Defined Networking (SDN), control functions are stripped out and centralized in the software-based SDN controller, while the underlying network devices only need to accept and execute instructions from the controller. The basic architecture of SDN consists of three layers and two interfaces. The application layer communicates with the SDN controller by calling the API. The SDN controller communicates with the network switch on the data plane through the OpenFlow protocol to realize the forward control of network traffic. OpenFlow is a mainstream protocol for southbound interfaces. The data plane is made up of many network switches that are only responsible for the forwarding and exchange of packets. The network switch communicates with the controller through the OpenFlow protocol to perform specific processing or forwarding operations on packets according to the controller's instructions. SDN has been widely used in data centers and cloud computing due to its centralized control and flexible programmability [2]. However, the decoupling of the control plane and data plane of the SDN architecture makes it a key target for cyberattacks. Network attacks on the SDN are mainly launched on the forwarding plane and control plane. Among the possible attacks on the SDN control plane and forwarding plane, DoS attacks take the most forms and are easiest to organize. A large amount of malicious traffic is generated to overload the SDN controller or switch, resulting in an overload of the control channel, which seriously affects the quality of service, and even makes the entire network unavailable. Because the forwarding plane is directly connected to external users, attacks are more diverse, such as switch hijacking, SDN scanning, address resolution protocol (ARP) attacks, and virus attacks. For example, in an ARP attack, the attacker sends a large number of ARP packets containing the incorrect mapping between MAC addresses and IP addresses. As a result, the switch cannot store the correct MAC address information and therefore cannot implement normal forwarding services. On the control plane, attackers can directly launch resource-consuming attacks on network controllers and send a large number of Packet-in messages to block the processing queue of the controller or even cause the entire network to crash. Attackers can also launch a variety of attacks by forging North-South interface conversation messages, such as DDoS attacks, black hole attacks, malicious insertion of flow rules, and so on. Because of its centralized control, SDN sometimes faces more complex attack challenges than traditional networks. In the SDN environment, the traditional anomaly detection methods mainly rely on rule-based matching and statistical analysis techniques.