{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T19:07:53Z","timestamp":1771700873368,"version":"3.50.1"},"reference-count":31,"publisher":"MDPI AG","issue":"19","license":[{"start":{"date-parts":[[2022,9,30]],"date-time":"2022-09-30T00:00:00Z","timestamp":1664496000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Key Technology Research and Development Program of the Zhejiang Province","award":["2022C01125"],"award-info":[{"award-number":["2022C01125"]}]},{"name":"Key Technology Research and Development Program of the Zhejiang Province","award":["62072146"],"award-info":[{"award-number":["62072146"]}]},{"name":"National Natural Science Foundation of China","award":["2022C01125"],"award-info":[{"award-number":["2022C01125"]}]},{"name":"National Natural Science Foundation of China","award":["62072146"],"award-info":[{"award-number":["62072146"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>With the advent of the digital information age, new data services such as virtual reality, industrial Internet, and cloud computing have proliferated in recent years. As a result, it increases operator demand for 5G bearer networks by providing features such as high transmission capacity, ultra-long transmission distance, network slicing, and intelligent management and control. Software-defined networking, as a new network architecture, intends to increase network flexibility and agility and can better satisfy the demands of 5G networks for network slicing. Nevertheless, software-defined networking still faces the challenge of network intrusion. We propose an abnormal traffic detection method based on the stacking method and self-attention mechanism, which makes up for the shortcoming of the inability to track long-term dependencies between data samples in ensemble learning. Our method utilizes a self-attention mechanism and a convolutional network to automatically learn long-term associations between traffic samples and provide them to downstream tasks in sample embedding. In addition, we design a novel stacking ensemble method, which computes the sample embedding and the predicted values of the heterogeneous base learner through the fusion module to obtain the final outlier results. This paper conducts experiments on abnormal traffic datasets in the software-defined network environment, calculates precision, recall and F1-score, and compares and analyzes them with other algorithms. The experimental results show that the method designed in this paper achieves 0.9972, 0.9996, and 0.9984 in multiple indicators of precision, recall, and F1-score, respectively, which are better than the comparison methods.<\/jats:p>","DOI":"10.3390\/s22197436","type":"journal-article","created":{"date-parts":[[2022,10,10]],"date-time":"2022-10-10T03:07:28Z","timestamp":1665371248000},"page":"7436","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":30,"title":["An Anomaly Detection Algorithm Based on Ensemble Learning for 5G Environment"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7313-9140","authenticated-orcid":false,"given":"Lifeng","family":"Lei","sequence":"first","affiliation":[{"name":"Computer & Software School, Hangzhou Dianzi University, Hangzhou 310018, China"}]},{"given":"Liang","family":"Kou","sequence":"additional","affiliation":[{"name":"Computer & Software School, Hangzhou Dianzi University, Hangzhou 310018, China"}]},{"given":"Xianghao","family":"Zhan","sequence":"additional","affiliation":[{"name":"Computer & Software School, Hangzhou Dianzi University, Hangzhou 310018, China"}]},{"given":"Jilin","family":"Zhang","sequence":"additional","affiliation":[{"name":"Computer & Software School, Hangzhou Dianzi University, Hangzhou 310018, China"}]},{"given":"Yongjian","family":"Ren","sequence":"additional","affiliation":[{"name":"Computer & Software School, Hangzhou Dianzi University, Hangzhou 310018, China"}]}],"member":"1968","published-online":{"date-parts":[[2022,9,30]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1145\/1355734.1355746","article-title":"OpenFlow: Enabling innovation in campus networks","volume":"38","author":"McKeown","year":"2008","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1086","DOI":"10.1109\/TR.2015.2421391","article-title":"A Survey of Securing Networks Using Software Defined Networking","volume":"64","author":"Ali","year":"2015","journal-title":"IEEE Trans. Reliab."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"325","DOI":"10.1109\/COMST.2016.2618874","article-title":"Software defined networking architecture, security and energy efficiency: A survey","volume":"19","author":"Rawat","year":"2016","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Bian, S., Zhang, P., and Yan, Z. (2016, January 18\u201320). A survey on software-defined networking security. Proceedings of the 9th EAI International Conference on Mobile Multimedia Communications, Xi\u2019an, China.","DOI":"10.4108\/eai.18-6-2016.2264176"},{"key":"ref_5","first-page":"25","article-title":"Research Development of Abnormal Traffic Detection in Software Defined Networking","volume":"31","author":"Xu","year":"2020","journal-title":"J. Softw."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Scott-Hayward, S., O\u2019Callaghan, G., and Sezer, S. (2013, January 11\u201313). SDN security: A survey. Proceedings of the 2013 IEEE SDN for Future Networks and Services (SDN4FNS), Trento, Italy.","DOI":"10.1109\/SDN4FNS.2013.6702553"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1527","DOI":"10.1162\/neco.2006.18.7.1527","article-title":"A fast learning algorithm for deep belief nets","volume":"18","author":"Hinton","year":"2006","journal-title":"Neural Comput."},{"key":"ref_8","unstructured":"Jackson, K., DuBois, D., and Stallings, C. (1991, January 1\u20134). An expert system application for network intrusion detection. Proceedings of the National Computer Security Conference, Washington, DC, USA."},{"key":"ref_9","unstructured":"Javitz, H.S., and Valdes, A. (1991, January 20\u201322). The SRI IDES statistical anomaly detector. Proceedings of the 1991 IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, CA, USA."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Sekar, R., Gupta, A., Frullo, J., Shanbhag, T., Tiwari, A., Yang, H., and Zhou, S. (2002, January 18\u201322). Specification-based anomaly detection: A new approach for detecting network intrusions. Proceedings of the CCS02: ACM Conference on Computer and Communications Security, Washington, DC, USA.","DOI":"10.1145\/586143.586146"},{"key":"ref_11","unstructured":"Bauer, D.S., and Koblentz, M.E. NIDX\u2014An expert system for real-time network intrusion detection. In Proceedings of the 1988 Computer Networking Symposium, Washington, DC, USA, 11\u201313 April 1988."},{"key":"ref_12","unstructured":"Sinclair, C., Pierce, L., and Matzner, S. (1999, January 6\u201310). An application of machine learning to network intrusion detection. Proceedings of the 15th Annual Computer Security Applications Conference (ACSAC\u201999), Phoenix, AZ, USA."},{"key":"ref_13","unstructured":"Goldstein, M., and Dengel, A. (2012, January 24\u201327). Histogram-based outlier score (hbos): A fast unsupervised anomaly detection algorithm. Proceedings of the KI-2012: Poster and Demo Track, Saarbr\u00fccken, Germany."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1109\/TCNS.2014.2378631","article-title":"Statistical traffic anomaly detection in time-varying communication networks","volume":"2","author":"Wang","year":"2015","journal-title":"IEEE Trans. Control Netw. Syst."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"2191","DOI":"10.1109\/TSP.2003.814797","article-title":"Anomaly detection in IP networks","volume":"51","author":"Thottan","year":"2003","journal-title":"IEEE Trans. Signal Process."},{"key":"ref_16","unstructured":"Buschkes, R., Kesdogan, D., and Reichl, P. (1998, January 7\u201311). How to increase security in mobile networks by anomaly detection. Proceedings of the 14th Annual Computer Security Applications Conference (Cat. No. 98EX217), Phoenix, AZ, USA."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"302","DOI":"10.1109\/TSMCB.2005.843274","article-title":"Hierarchical Kohonenen Net for anomaly detection in network security","volume":"35","author":"Sarasamma","year":"2005","journal-title":"IEEE Trans. Syst. Man Cybern. Part B Cybern."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"494","DOI":"10.1109\/TDSC.2011.14","article-title":"Anomaly detection in network traffic based on statistical inference and \u03b1-stable modeling","volume":"8","author":"Dimitriadis","year":"2011","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_19","unstructured":"Sui, S., Li, L., and Manikopoulo, C.N. (2006, January 23\u201325). Flow-based Statistical Aggregation Schemes for Network Anomaly Detection. Proceedings of the 2006 IEEE International Conference on Networking, Sensing and Control, Ft. Lauderdale, FL, USA."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"131","DOI":"10.1109\/TNET.2017.2765719","article-title":"Anomaly detection and attribution in networks with temporally correlated traffic","volume":"26","author":"Nevat","year":"2018","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_21","unstructured":"Qu, D., Vetter, B.M., Wang, F., Narayan, R., Wu, S.F., Jou, Y.F., Gong, F., and Sargor, C. (1998, January 13\u201316). Statistical anomaly detection for link-state routing protocols. Proceedings of the Sixth International Conference on Network Protocols (Cat. No. 98TB100256), Austin, TX, USA."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Soule, A., Salamatian, K., and Taft, N. (2005, January 19\u201321). Combining filtering and statistical methods for anomaly detection. Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement, Berkeley, CA, USA.","DOI":"10.1145\/1330107.1330147"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Li, Z., Zhao, Y., Botta, N., Ionescu, C., and Hu, X. (2020). COPOD: Copula-based outlier detection. arXiv.","DOI":"10.1109\/ICDM50108.2020.00135"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"7700","DOI":"10.1109\/ACCESS.2018.2803446","article-title":"A Self-Adaptive Deep Learning-Based System for Anomaly Detection in 5G Networks","volume":"6","author":"Maimo","year":"2018","journal-title":"IEEE Access"},{"key":"ref_25","unstructured":"Van, N.T., Thinh, T.N., and Sach, L.T. (2017, January 21\u201323). An anomaly-based network intrusion detection system using Deep learning. Proceedings of the 2017 International Conference on System Science and Engineering (ICSSE), Ho Chi Minh City, Vietnam."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"924","DOI":"10.1109\/TNSM.2019.2927886","article-title":"A hybrid deep learning-based model for anomaly detection in cloud datacenter networks","volume":"16","author":"Garg","year":"2019","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Tang, T.A., Mhamdi, L., McLernon, D., Zaidi, S.A.R., and Ghogho, M. (2016, January 26\u201329). Deep learning approach for Network Intrusion Detection in Software Defined Networking. Proceedings of the 2016 International Conference on Wireless Networks and Mobile Communications (WINCOM), Fez, Morocco.","DOI":"10.1109\/WINCOM.2016.7777224"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"566","DOI":"10.1109\/TMM.2019.2893549","article-title":"Hybrid deep-learning-based anomaly detection scheme for suspicious flow detection in SDN: A social multimedia perspective","volume":"21","author":"Garg","year":"2019","journal-title":"IEEE Trans. Multimed."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Yang, L., Song, Y., Gao, S., Xiao, B., and Hu, A. (2020, January 7\u201311). Griffin: An Ensemble of AutoEncoders for Anomaly Traffic Detection in SDN. Proceedings of the GLOBECOM 2020\u20142020 IEEE Global Communications Conference, Taipei, Taiwan.","DOI":"10.1109\/GLOBECOM42002.2020.9322187"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"763","DOI":"10.1016\/j.future.2019.10.015","article-title":"Towards sFlow and adaptive polling sampling for deep learning based DDoS detection in SDN","volume":"111","author":"Ujjan","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"165263","DOI":"10.1109\/ACCESS.2020.3022633","article-title":"InSDN: A novel SDN intrusion dataset","volume":"8","author":"Elsayed","year":"2020","journal-title":"IEEE Access"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/19\/7436\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T00:44:33Z","timestamp":1760143473000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/22\/19\/7436"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,9,30]]},"references-count":31,"journal-issue":{"issue":"19","published-online":{"date-parts":[[2022,10]]}},"alternative-id":["s22197436"],"URL":"https:\/\/doi.org\/10.3390\/s22197436","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,9,30]]}}}