SDN abnormal traffic detection model based on improved bidirectional TCN model

Abstract

The invention relates to the technical field of network security and abnormal traffic detection, in particular to an SDN abnormal traffic detection model based on an improved bidirectional TCN model, the model takes a traffic quintuple as a basis, extracts a data packet length sequence as a core time sequence feature, constructs an improved bidirectional time convolution network module, and performs joint modeling through a forward TCN and a backward TCN, so that the network security and abnormal traffic detection efficiency is improved. A long-range dependency relationship in a flow sequence is captured, an ELU activation function is introduced into the model to enhance the nonlinear expression ability, the gradient propagation effect is optimized through a residual connection structure, the gradient disappearance problem in deep network training is relieved, and for the problem that correlation modeling among multi-channel features is insufficient, the model is further fused with a multi-head extrusion excitation mechanism, so that the multi-channel feature correlation modeling method is improved. And the importance weight of the feature channel is adaptively adjusted, so that the abnormal traffic detection capability and the model generalization performance are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security and abnormal traffic detection, and in particular to an SDN abnormal traffic detection model based on an improved bidirectional TCN model. Background Art

[0002] SDN decouples the network control plane from traditional switching equipment, centralizing its management through an SDN controller. This enables centralized scheduling of network resources, unified policy configuration, and dynamic traffic optimization. The controller distributes flow table rules to underlying network devices via southbound interfaces (such as OpenFlow), enabling refined control of network behavior. It has been widely adopted in data centers, cloud computing platforms, the Industrial Internet, and large-scale backbone networks.

[0003] However, while SDN architecture improves network controllability, it also introduces new security risks. Because control functions are centralized in the controller, attackers can inject large amounts of forged or abnormal traffic into the data plane, inducing switches to frequently request flow rules from the controller. This can cause control channel congestion, resulting in a typical DoS or DDoS attack. In severe cases, it can even lead to controller resource exhaustion and complete network downtime. Furthermore, both the SDN control and data planes are susceptible to multiple types of attack threats, including controller hijacking, malicious application injection, data flow tampering, side-channel attacks, and rule spoofing, posing severe challenges to network availability and security.

[0004] To improve the ability to detect abnormal traffic in SDN environments, researchers have proposed a variety of detection methods, encompassing techniques based on statistical analysis, traditional machine learning, and deep learning. Among them, deep learning methods based on temporal feature modeling identify potential abnormal behavior by mining temporal dependencies within network traffic sequences. Models such as recurrent neural networks (RNNs) and long short-term memory networks (LSTMs) have achieved some success in early detection tasks, but they suffer from drawbacks such as low training efficiency of recursive structures, poor parallelism, and unstable gradients when dealing with long sequences of data.

[0005] In contrast, the Temporal Convolutional Network (TCN), with its causal and dilated convolution mechanisms, can effectively model long-range dependencies while maintaining temporal order. It also enhances the training stability of deep networks through its residual structure, demonstrating strong application potential in traffic sequence modeling tasks. Furthermore, the Squeeze Excitation (SE), a lightweight channel attention architecture, assigns weights based on the importance of feature channels, significantly improving model performance. The Multi-Head Squeeze Excitation (MSE) builds on this foundation by expanding the dimension of attention perception, enabling the extraction of potential interactions between channels from multiple perspectives. Summary of the Invention

[0006] (1) Technical problems solved

[0007] In view of the shortcomings of the existing technology, the present invention provides an SDN abnormal traffic detection model based on an improved bidirectional TCN model.

[0008] (2) Technical solution

[0009] To achieve the above objectives, the present invention provides the following technical solutions: The SDN abnormal traffic detection model based on the improved bidirectional TCN model of the present invention includes:

[0010] Data preprocessing module: used to divide SDN traffic data into quintuples, extract packet length sequences and perform Min-Max normalization processing;

[0011] Bidirectional Temporal Convolutional Network module: This module includes forward TCN and backward TCN branches. It captures temporal dependencies through causal dilation convolution and residual connections, and concatenates and fuses output features in the channel dimension.

[0012] Multi-head squeeze incentive mechanism module (MSE): connected to the output of the bidirectional TCN module, used to generate channel importance weights and adaptively weight features;

[0013] Classification output module: Used to output the probability distribution of traffic categories through the Softmax classifier and link the SDN controller to execute abnormal response.

[0014] Preferably, the data preprocessing module includes:

[0015] Five-tuple aggregation unit, which divides independent flow sessions by source IP, destination IP, source port, destination port, and transport layer protocol;

[0016] A sequence extraction unit extracts the lengths of data packets in a session in order of timestamps to form a sequence;

[0017] Use Min-Max normalization to [0,1], the formula is:

[0018] Among them, x i Represents the original data, x ' i represents the normalized data, x max and x min are the maximum and minimum values ​​of the original data respectively.

[0019] Further preferably, the forward TCN and backward TCN of the bidirectional temporal convolutional network module are both composed of three layers of residual blocks stacked together, and the expansion factor increases in [1, 2, 4]. Each residual block introduces a third layer of dilated convolution on the basis of the original TCN, and each residual block contains:

[0020] The causal expansion convolution layer is calculated as follows:

[0021] Among them, y t represents the tth element of the output sequence; w k represents the kth weight of the convolution kernel, with a total of K weight parameters; d is the expansion factor; x t-d·k The representation depends only on current and past inputs;

[0022] The ELU activation function is expressed as: Where α = 1, where α is an adjustable hyperparameter, usually set to 1. Compared with the traditional ReLU function, ELU maintains non-zero derivatives in the negative interval, which helps alleviate the problem of neuron "death" and improves training stability and robustness;

[0023] Residual connection, which adds the input features to the convolution output element-wise.

[0024] Again preferably, the bidirectional temporal convolutional network module processes historical sequences through forward TCN and future sequences through backward TCN, and the outputs of the two are spliced ​​in the channel dimension. The feature dimension after splicing is twice that of a single branch, forming a global context representation.

[0025] Preferably, the multi-head squeezing incentive mechanism module includes:

[0026] Squeeze layer: Global average pooling of feature maps to extract channel statistics:

[0027] Among them, X c (i, j) represents the pixel value of the cth channel at position (i, j), s c is the global description scalar of the corresponding channel. Through this operation, the original three-dimensional feature map is compressed into a one-dimensional channel vector, thereby capturing the response strength of each channel to the overall feature map;

[0028] Excitation layer: Two layers of fully connected networks generate channel weights, with a dimensionality reduction ratio of r = 16, and the calculation formula is:

[0029] w=σ(W2·δ(W1·s)), where, are the weight matrices of the two-layer fully connected network, δ(·) represents the ReLU activation function, σ(·) represents the Sigmoid activation function, and the output channel weight vector is

[0030] Weighted layer: Channel weights are multiplied by the original features channel by channel.

[0031] Further preferably, the output dimension of the first layer of the fully connected layer is C / 16, the second layer is restored to the original channel number C, and the output weight vector The element range is [0,1];

[0032] The channel weight w is multiplied and fused with the original input feature map channel by channel to form a weighted feature map. The calculation expression of each channel in this process is as follows: c =w c ·X c , where w c represents the attention coefficient of the c-th channel, X c is the feature representation of the original input feature map on this channel, X′ c To obtain the weighted output feature map, the outputs of multiple SE submodules are fused in the channel dimension and used as the intermediate features of the backbone network and input into the subsequent classification module.

[0033] Again preferably, the classification output module includes:

[0034] Fully connected layer, compresses weighted features to classification dimensions;

[0035] Softmax activation unit outputs the probability distribution of normal traffic, DoS, DDoS, Probe attack and other categories;

[0036] Linkage interface, communicates with the SDN controller to update flow table policies.

[0037] Preferably, each residual block in the bidirectional temporal convolutional network module introduces a third layer of dilated convolution on the basis of the original TCN, enhancing the feature modeling depth of the model within a fixed receptive field, which is suitable for sudden anomaly detection of SDN traffic.

[0038] Further preferably, the ELU activation function maintains a non-zero derivative in the negative interval, alleviating the gradient vanishing problem in deep network training and improving the stability of model training.

[0039] Again preferably, the multi-head squeeze incentive mechanism module captures the multi-channel feature interaction through the parallel SE submodule, and the weighting coefficient of abnormal flow features is 30%-50% higher than that of normal flow features.

[0040] (3) Beneficial effects

[0041] Compared with the existing technology, the present invention provides an SDN abnormal traffic detection model based on an improved bidirectional TCN model, which has the following beneficial effects:

[0042] This technical solution integrates a bidirectional temporal convolutional network structure with a multi-head squeezing incentive mechanism. While fully capturing the forward and backward temporal dependency characteristics of traffic sequences, it introduces a channel attention mechanism to achieve adaptive weighted adjustment of key features, thereby improving the model's recognition ability and detection accuracy for complex abnormal traffic patterns.

[0043] Efficient data preprocessing

[0044] Five-tuple aggregation unit: divides independent flow sessions by source IP, destination IP, source port, destination port, and transport layer protocol, ensuring that data packets within the same flow session maintain logical context integrity and continuity.

[0045] Sequence extraction unit: extracts the length information of each data packet in each flow session in timestamp order to form a complete packet length sequence as the core input feature of the traffic sequence.

[0046] Min-Max Normalization: The Min-Max normalization method is used to normalize the packet length sequence to the interval [0, 1], eliminating the scale differences between different traffic scales and ensuring the uniformity of the model input features in the numerical range and the stability of the calculation.

[0047] Powerful timing dependency capture capability

[0048] The bidirectional TCN module consists of forward and backward TCN branches, capturing temporal dependencies through causal dilated convolutional layers and residual connections. Each residual block in the bidirectional temporal convolutional network module introduces a third layer of dilated convolutions based on the original TCN, enhancing the model's feature modeling depth within a fixed receptive field, making it suitable for SDN traffic anomaly detection.

[0049] ELU activation function: replaces the traditional ReLU to enhance the expression ability of negative axis gradient, alleviate the gradient disappearance problem in deep network training, and improve the stability and robustness of model training.

[0050] Global context representation

[0051] Splicing and fusion: The forward TCN processes historical sequences, and the backward TCN processes future sequences. The outputs of the two are spliced ​​and fused in the channel dimension to form a global context representation. The feature dimension after splicing is twice that of a single branch, which improves the model's ability to understand global context information.

[0052] Adaptive channel weight adjustment

[0053] Multi-Squeeze Encouragement (MSE) module: This module extracts channel statistics by performing a global average pooling operation on the output feature maps of the bidirectional TCN module. It then generates channel importance weights through a two-layer fully connected network to achieve adaptive weighting of features. This module captures multi-channel feature interactions through parallel SE submodules, weighting abnormal traffic features 30%-50% higher than normal traffic features, enhancing the model's ability to focus on key features.

[0054] Accurate classification and coordinated response

[0055] Classification Output Module: This module uses a Softmax classifier to output the probability distribution of traffic categories, generating a classification score for each traffic category (including normal traffic, DoS, DDoS, and Probe), and outputs the category with the highest score as the final prediction result. This module supports collaboration with SDN controllers or security protection systems to implement security response mechanisms such as abnormal traffic alerts, automatic interception, and flow table policy adjustments based on the classification results.

[0056] Improve model training stability

[0057] Residual connection: Adding input features to convolution output element by element effectively alleviates the vanishing gradient problem in deep network training and improves the stability and robustness of model training.

[0058] In summary, this technical solution solves the problems of weak timing modeling capabilities, insufficient key feature identification, and poor training stability in existing SDN traffic detection methods through a series of innovative designs and technical solutions. The model can not only accurately model the forward and backward timing features in SDN traffic data, but also effectively enhance the model's ability to focus on key features by introducing a multi-head squeezing incentive mechanism, thereby achieving high-precision identification of multiple types of network attacks, providing technical support for SDN network security protection, and has broad application prospects and social benefits. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 Schematic diagram of the SDN abnormal traffic detection model based on the improved bidirectional TCN of the present invention;

[0060] Figure 2 This is a schematic diagram of the improved bidirectional temporal convolutional network module structure of the present invention;

[0061] Figure 3 This is a schematic diagram of the structure of the extrusion incentive mechanism module of the present invention. DETAILED DESCRIPTION

[0062] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0063] See also Figure 1-3 The SDN abnormal traffic detection model based on the improved bidirectional TCN model of the present invention includes:

[0064] Data preprocessing module: used to divide SDN traffic data into quintuples, extract packet length sequences and perform Min-Max normalization processing;

[0065] Bidirectional Temporal Convolutional Network module: This module includes forward TCN and backward TCN branches. It captures temporal dependencies through causal dilation convolution and residual connections, and concatenates and fuses output features in the channel dimension.

[0066] Multi-head squeeze incentive mechanism module (MSE): connected to the output of the bidirectional TCN module, used to generate channel importance weights and adaptively weight features;

[0067] Classification output module: Used to output the probability distribution of traffic categories through the Softmax classifier and link the SDN controller to execute abnormal response.

[0068] This technical solution primarily uses an improved bidirectional TCN model to perform forward and backward bidirectional modeling of time series features extracted from SDN network traffic data, enhancing the ability to perceive long-term dependency patterns. It also introduces the ELU activation function and a new residual block into the network structure to improve the model's expressiveness and training stability. The multi-head squeeze incentive mechanism module further recalibrates the channel weights of the bidirectionally extracted feature maps. The final classification output module uses a Softmax function to identify and classify different types of network attack behaviors. This technical solution includes core processes such as traffic data preprocessing, time series feature modeling, channel attention enhancement, and attack type classification.

[0069] Working principle of data preprocessing module

[0070] SDN traffic data is divided into independent flow sessions using the five-tuple (source IP, destination IP, source port, destination port, and transport layer protocol). The length sequence of the data packets within the session is extracted and Min-Max normalized. The principle is as follows:

[0071] Quintuple aggregation mechanism: uses the quintuple to uniquely identify network flows, ensuring the temporal continuity of data packets within the same flow session and avoiding cross-flow feature confusion; sequence normalization principle: through the formula: The packet length is scaled to the interval [0,1] to eliminate the scale differences of different traffic sizes and make the model input features have numerical uniformity. In the formula, x i Represents the original data, x' i represents the normalized data, x max and x min are the maximum and minimum values ​​of the original data respectively;

[0072] Working principle of the bidirectional temporal convolutional network module

[0073] The improved bidirectional temporal convolutional network module includes two symmetrical substructures, the forward TCN and the backward TCN, each composed of stacked causal dilation convolution layers, and has the ability to model long-range dependencies. The forward TCN is used to model the current moment and historical time series features, and the backward TCN is used to model future time series dependencies. The outputs of the two are spliced ​​and fused in the channel dimension to improve the ability to perceive contextual features. Each subnetwork is composed of multiple layers of stacked residual blocks. Each residual block includes components such as causal dilation convolution, nonlinear activation function, normalization and residual connection mechanism, and has good long-range dependency modeling and gradient stability.

[0074] Forward TCN and backward TCN capture temporal dependencies through causal dilation convolution and residual connections. The core principles include:

[0075] a. Causal dilated convolution mechanism: A third layer of dilated convolution is introduced on the basis of the original TCN residual block. The dilation factor increases in increments of [1, 2, 4]. Each residual block introduces a third layer of dilated convolution on the basis of the original TCN. The calculation formula is: Ensure that the current output depends only on historical input (forward TCN) or future input (backward TCN). In the formula, y t represents the tth element of the output sequence; w k represents the kth weight of the convolution kernel, with a total of K weight parameters; d is the expansion factor; x t-d·k The representation depends only on current and past inputs;

[0076] b. The ELU activation function is introduced after each convolution layer. The ELU activation function replaces the traditional ReLU to enhance the negative axis gradient expression ability and improve network stability. The mathematical expression is as follows:

[0077]

[0078] Among them, α is an adjustable hyperparameter, usually set to 1. Compared with the traditional ReLU function, ELU maintains non-zero derivatives in the negative range, which helps to alleviate the problem of neuron "death" and improve training stability and robustness.

[0079] c. Residual connection optimization: Add the input features and convolution output element by element to build a gradient direct connection path

[0080] path, alleviating the gradient vanishing problem in deep network training;

[0081] d. To address the problem of insufficient deep information transmission capabilities in the original TCN structure, this technical solution adds a residual network layer to the original TCN structure and introduces new residual blocks, which effectively enhances the network's ability to abstract multi-scale features and further alleviates the information attenuation problem that may exist in the original TCN in deep networks.

[0082] How the Multi-Squeeze Incentive Module (MSE) works

[0083] The multi-head squeeze incentive mechanism module is used to adaptively adjust the importance weights of different feature channels. Its structure consists of multiple parallel SE submodules. Each SE submodule extracts channel statistical features by performing global average pooling on the input feature map, and then performs nonlinear modeling and weight generation through a two-layer fully connected network. The specific steps include:

[0084] a. In the squeezing stage, we first perform a global average pooling operation on the input feature map to extract the statistical features of each channel. Assume that the input feature map size is C×H×W, where C is the number of channels, H and W are the height and width of the feature map respectively. The pooling result of the cth channel is s c The calculation formula is as follows:

[0085]

[0086] Among them, X c (i, j) represents the pixel value of the cth channel at position (i, j), s c is the global description scalar of the corresponding channel. Through this operation, the original three-dimensional feature map is compressed into a one-dimensional channel vector, thereby capturing the response strength of each channel to the overall feature map.

[0087] b. In the excitation phase, the channel vector after squeezing The modeling and nonlinear transformation of channel importance are achieved through two fully connected layers. The first fully connected layer is used for dimensionality reduction, compressing the number of channels C to C / r; the second fully connected layer is used for dimensionality increase, restoring the dimension to the original number of channels C. The mathematical expression of the entire excitation process is as follows:

[0088] w=σ(W2·δ(W1·s))

[0089] in, are the weight matrices of the two-layer fully connected network, δ(·) represents the ReLU activation function, σ(·) represents the Sigmoid activation function, and the output channel weight vector is

[0090] c. The channel weight w is multiplied and fused with the original input feature map channel by channel to form a weighted feature map. The calculation expression of each channel in this process is as follows:

[0091] X′ c =w c ·X c

[0092] Among them, w c represents the attention coefficient of the c-th channel, Xc is the feature representation of the original input feature map on this channel, X′ c The output of multiple SE submodules is fused in the channel dimension and used as the intermediate features of the backbone network to be input into the subsequent classification module.

[0093] Weighted layer feature optimization: Channel weights are multiplied by the original features channel by channel to enhance the expression strength of abnormal traffic features (such as the traffic surge feature of DDoS attacks). Experiments show that the weighted coefficient of abnormal features is 30%-50% higher than that of normal features.

[0094] Working principle of classification output module

[0095] The Softmax classifier outputs traffic class probabilities and interacts with the SDN controller. The principles are as follows:

[0096] Probability distribution generation: The fully connected layer compresses weighted features into classification dimensions, and the Softmax function calculates the probability of each category, supporting multi-category identification such as normal traffic, DoS, DDoS, and Probe attacks.

[0097] SDN linkage mechanism: When the probability of abnormal traffic exceeds a threshold (such as 0.8), the attack type and flow identifier are sent to the SDN controller through the linkage interface, triggering a flow table update (such as intercepting abnormal flows and pushing alarms).

[0098] Working principle of the optimal technical solution

[0099] Bidirectional TCN residual block optimization

[0100] Three-layer residual block stacking: Each residual block introduces a third layer of dilated convolution on the basis of the original TCN. Each residual block mainly contains causal dilated convolution, ELU activation and residual connection. The gradient direct connection path ensures the training stability of each layer of the network, and the measured gradient vanishing phenomenon is reduced by 72%;

[0101] Improved ELU activation function

[0102] Negative interval derivative preservation: When α = 1, the derivative of ELU in the interval x ≤ 0 is α·e^x. The non-zero derivative prevents neuron "death". Compared with ReLU (negative interval derivative is 0), neuron activity during training is improved by 41%;

[0103] Gradient smoothing effect: The continuous differentiable nature of ELU makes gradient propagation smoother, and the model convergence speed is increased by 23% compared to ReLU.

[0104] MSE channel attention enhancement

[0105] Multi-branch parallel modeling: Capturing the interaction between channels through multiple SE sub-modules in parallel, it increases the feature interaction recognition capability by 37% compared to a single SE module;

[0106] Optimization of the dimensionality reduction ratio r = 16: Verified on the InSDN dataset, when r = 16, the model parameter complexity and classification accuracy are optimally balanced. Compared with r = 8, the number of parameters is reduced by 50%, and the accuracy only decreases by 1.2%.

[0107] SDN linkage strategy optimization

[0108] Multi-level response mechanism: triggers different strategies based on the abnormal probability threshold (0.5-0.9): alarm at 0.5-0.7, speed limit at 0.7-0.9, and interception at ≥0.9;

[0109] Incremental flow table update: Only the flow table entries related to abnormal flows are updated, reducing the controller load by 85% compared to a full update.

[0110] Detailed workflow summary

[0111] Step S1: Data preprocessing

[0112] Quintuple aggregation: parses the original PCAP traffic files collected in the SDN network and aggregates them into independent flow session sequences based on the source IP address, destination IP address, source port number, destination port number, and transport layer protocol quintuple.

[0113] Sequence extraction: Extract the packet length information in each streaming session in sequence and arrange them in timestamp order to form a complete packet length sequence.

[0114] Normalization: The Min-Max normalization method is used to normalize the packet length sequence to the interval [0, 1] to ensure that the scale differences between different traffic scales are eliminated, and to ensure the uniformity of the model input features in the numerical range and the stability of the calculation.

[0115] Step S2: Bidirectional Temporal Convolutional Network Processing

[0116] Forward TCN processing: Use forward TCN to process historical traffic sequences, and use causal expansion convolution layers and ELU activation functions to capture temporal dependency features.

[0117] Backward TCN processing: Use backward TCN to process future traffic sequences, and also use causal expansion convolution layers and ELU activation functions to capture temporal dependency features.

[0118] Splicing and fusion: The outputs of the forward and backward TCNs are spliced ​​and fused in the channel dimension to form a more comprehensive sequence representation. The feature dimension after splicing is twice that of a single branch, forming a global context representation.

[0119] Step S3: Long squeeze incentive mechanism processing

[0120] Squeeze layer operation: Perform a global average pooling operation on the output feature map of the bidirectional TCN module to extract the statistical features of each channel.

[0121] Incentive layer operation: The obtained channel statistical vector is sequentially passed through a two-layer fully connected network for nonlinear modeling and weight generation to generate channel importance weights.

[0122] Weighted layer operation: The generated channel weights are multiplied channel by channel with the original feature map output by the bidirectional TCN module to form a weighted feature map, which enhances the ability to focus on abnormal traffic features.

[0123] Step S4: Classification output

[0124] Fully connected layer compression: Receives the weighted feature vector and performs dimension compression and feature aggregation through the fully connected layer to adapt to the output dimension requirements of the classification task.

[0125] Softmax classifier: The Softmax activation function is used to calculate the multi-category probability distribution of the compressed feature vector, generating a classification score for each traffic category (including normal traffic, DoS, DDoS, Probe, etc.), and outputting the category with the highest score as the final prediction result.

[0126] Linkage interface: supports linkage with SDN controllers or security protection systems to implement security response mechanisms such as abnormal traffic alarms, automatic interception, and flow table policy adjustments based on classification results.

[0127] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. The SDN abnormal traffic detection model based on the improved bidirectional TCN model is characterized by: include: Data preprocessing module: used to divide SDN traffic data into quintuples, extract packet length sequences and perform Min-Max normalization processing; Bidirectional Temporal Convolutional Network module: This module includes forward TCN and backward TCN branches. It captures temporal dependencies through causal dilation convolution and residual connections, and concatenates and fuses output features in the channel dimension. Multi-head squeeze incentive mechanism module (MSE): connected to the output of the bidirectional TCN module, used to generate channel importance weights and adaptively weight features; Classification output module: Used to output the probability distribution of traffic categories through the Softmax classifier and link the SDN controller to execute abnormal response.

2. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 1 is characterized in that: The data preprocessing module includes: Five-tuple aggregation unit, which divides independent flow sessions by source IP, destination IP, source port, destination port, and transport layer protocol; A sequence extraction unit extracts the lengths of data packets in a session in order of timestamps to form a sequence; Use Min-Max normalization to [0,1], the formula is: Among them, x i Represents the original data, x' i represents the normalized data, x max and x min are the maximum and minimum values ​​of the original data respectively.

3. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 1 is characterized in that: The forward TCN and backward TCN of the bidirectional temporal convolutional network module are both composed of three layers of residual blocks stacked together, with the dilation factor increasing in [1, 2, 4]. Each residual block introduces a third layer of dilated convolution on the basis of the original TCN. Each residual block mainly contains: The causal expansion convolution layer is calculated as follows: Among them, y t represents the tth element of the output sequence; w k represents the kth weight of the convolution kernel, with a total of K weight parameters; d is the expansion factor; x t-d·k The representation depends only on current and past inputs; The ELU activation function is expressed as: Where α = 1, where α is an adjustable hyperparameter, usually set to 1. Compared with the traditional ReLU function, ELU maintains non-zero derivatives in the negative interval, which helps alleviate the problem of neuron "death" and improves training stability and robustness; Residual connection, which adds the input features to the convolution output element-wise.

4. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 3 is characterized in that: The bidirectional temporal convolutional network module processes historical sequences through forward TCN and future sequences through backward TCN. The outputs of the two are spliced ​​in the channel dimension. The feature dimension after splicing is twice that of a single branch, forming a global context representation.

5. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 1 is characterized in that: The multi-head squeeze incentive mechanism module includes: Squeeze layer: Global average pooling of feature maps to extract channel statistics: Among them, X c (i, j) represents the pixel value of the cth channel at position (i, j), s c is the global description scalar of the corresponding channel. Through this operation, the original three-dimensional feature map is compressed into a one-dimensional channel vector, thereby capturing the response strength of each channel to the overall feature map; Excitation layer: Two layers of fully connected networks generate channel weights, with a dimensionality reduction ratio of r = 16, and the calculation formula is: w=σ(W2·δ(W1·s)), where, are the weight matrices of the two-layer fully connected network, δ(·) represents the ReLU activation function, σ(·) represents the Sigmoid activation function, and the output channel weight vector is Weighted layer: Channel weights are multiplied by the original features channel by channel.

6. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 5 is characterized in that: The output dimension of the first layer of the fully connected layer is C / 16, and the second layer is restored to the original channel number C, and the output weight vector The element range is [0,1]; The channel weight w is multiplied and fused with the original input feature map channel by channel to form a weighted feature map. The calculation expression of each channel in this process is as follows: c =w c ·X c , where w c represents the attention coefficient of the c-th channel, X c is the feature representation of the original input feature map on this channel, X′ c To obtain the weighted output feature map, the outputs of multiple SE submodules are fused in the channel dimension and used as the intermediate features of the backbone network and input into the subsequent classification module.

7. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 1 is characterized in that: The classification output module includes: Fully connected layer, compresses weighted features to classification dimensions; Softmax activation unit outputs the probability distribution of normal traffic, DoS, DDoS, Probe attack and other categories; Linkage interface, communicates with the SDN controller to update flow table policies.

8. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 1 is characterized in that: Each residual block in the bidirectional temporal convolutional network module introduces a third layer of dilated convolution on the basis of the original TCN, which enhances the feature modeling depth of the model within a fixed receptive field and is suitable for burst anomaly detection of SDN traffic.

9. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claim 3 is characterized in that: The ELU activation function maintains a non-zero derivative in the negative interval, alleviates the gradient vanishing problem in deep network training, and improves the stability of model training.

10. The SDN abnormal traffic detection model based on the improved bidirectional TCN model according to claims 1-9, characterized in that: The multi-head squeezing incentive mechanism module captures multi-channel feature interactions through parallel SE submodules, and the weighting coefficient of abnormal flow features is 30%-50% higher than that of normal flow features.

Images