Abnormal Traffic Detection Method Based on DCNN-GRU Architecture in SDN

In response to the centralized single-architecture abnormal traffic detection method in Software Defined Network (SDN), which consumes massive computational and network resources, and may lead to the decline of service quality of SDN network, this paper proposes a large-scale abnormal traffic detection method of SDN network based on Distributed Convolutional Neural Networks and Gate Recurrent Unit (DCNN-GRU) architecture. This method utilizes lightweight detection agents based on CNN deployed on each controller to extract traffic features preliminarily. Then it inputs the feature data into the GRU-based deep detection model hosted in the cloud for collaborative training and completes the final abnormal detection task. Since the feature extraction tasks are distributed across multiple controllers, the cloud server only needs to relearn and classify the extracted feature data, which is less costly than directly extracting feature information from the original traffic data and occupies less bandwidth resources than transmitting complete data packets. The experiment shows that the method achieves an abnormal detection accuracy of 0.9939, a recall rate of 0.9831, and a false alarm rate of only 0.0244, obtaining a higher precision and lower false alarm rate than traditional detection methods.