Abstract: Anomaly traffic detection methods in software defined network(SDN) have some problems in practice,such as high false alarm rate and frequent false alarms.In response to abnormal traffic attacks in the network,researchers have started to explore machine learning methods for abnormal traffic detection.However,machine learning methods face the challenges of large data sets and high data dimensionality,which affect the efficiency and accuracy of its performance,and thus require data reduction processing.Principal component analysis(PCA),as a linear transformation-based downscale algorithm,has certain limitations and cannot effectively estimate the principal components.To overcome this challenge,this paper proposes an improved dimensionality reduction algorithm,namely C-means Gaussian kernel principal component analysis(CGKPCA),which extend the capability of non-linear transformation.Also,this paper improves on the classification model by proposing an improved stacking model SVMS(support vector machine stacking).To validate the effectiveness of the proposed algorithms,experimental validation is conducted using the open source datasets KDDCPU99 and UNSW-NB15.The testing results indicate that the binary classification detection model proposed in this paper is significantly ahead of other models in terms of performance metrics.

Key words: Software defined network, Machine learning, Stacking model, Abnormal traffic detection, CGKPCA