Abstract: The centralized control feature of software defined network (SDN) technology enhances the efficiency of network management while also bringing more severe security threats. Accurately detecting abnormal traffic in the SDN network is critical for network security. To address the vulnerabilities of SDN networks to various attacks and the insufficient ability of existing methods in modeling the temporal characteristics of abnormal traffic, this paper proposes an abnormal traffic detection method suitable for the SDN environment. This method takes the fivetuple of the flow (source IP address, destination IP address, source port number, destination port number, transport layer protocol) as the division basis. The length sequence of data packets is extracted as the core temporal features. Based on the improved bidirectional temporal convolutional network (BiTCN), by changing the ELU activation function and adding a residual block in the original TCN structure, and simultaneously integrating the multihead squeeze excitation mechanism (MSE) to enhance the feature modeling ability, the identification of abnormal behaviors is achieved. The experimental results show that the method proposed in this paper achieves good effects on the public SDN dataset, and its accuracy, precision and other indicators are superior to the traditional baseline models.

Key words: abnormal traffic detection, software defined network (SDN), data packet length, deep learning

摘要： 软件定义网络(software defined network, SDN)技术的集中控制特性在提升网络管理效率的同时也带来更加严峻的安全威胁，准确地检测出SDN网络中的异常流量对网络安全至关重要.针对SDN网络可能遭受的网络攻击以及现有方法异常流量时序建模能力不足等问题，提出一种适用于SDN环境下的异常流量检测方法.该方法以流的五元组(源IP地址，目的IP地址，源端口号，目的端口号，传输层协议)为划分依据，提取数据包长度序列作为核心时序特征，并基于改进的双向时间卷积网络(bidirectional temporal convolutional network, BiTCN)，通过改用ELU激活函数并在原有时间卷积网络(temporal convolutional network, TCN)结构中增加一层残差网络，同时融合多头挤压激励机制(multihead squeeze excitation, MSE)以增强特征建模能力，实现对异常行为的识别.实验结果表明，该方法在公开SDN数据集上取得良好效果，其准确率、精确率等指标优于传统基线模型.

关键词: 异常流量检测, 软件定义网络, 数据包长度, 深度学习, 时间卷积网络