A lightweight distributed intrusion detection framework for SDN via unsupervised feature augmentation and collaborative LightGBM

With the rapid advancement of Internet technologies, the Internet of Things (IoT), edge computing, and software-defined networking (SDN) have emerged as key technologies for large-scale data processing in resource-constrained environments. However, the centralized control paradigm of SDN places substantial processing demands on a single controller, potentially resulting in excessive bandwidth overhead, high-dimensional data-processing challenges, and low computational efficiency. Moreover, the continuous data analytics and real-time policy enforcement required in heterogeneous networks further exacerbate controller-side performance bottlenecks. To address this issue, this study proposes a lightweight intrusion detection framework based on unsupervised representation learning and distributed collaborative learning, providing a potential perspective for achieving efficient classification in resource-constrained SDN environments. The principal contributions of this study are summarized as follows. (i) Unsupervised representation learning is employed to enrich the original feature space, while three complementary feature-selection strategies are used to identify the most informative features. This process preserves essential information while substantially reducing computational complexity. (ii) From a system-design perspective, the proposed framework exploits SDN programmability and the local processing capabilities of network nodes to distribute training tasks across individual nodes. This localized training architecture accelerates model training while effectively reducing communication overhead. (iii) Using only 13 key features selected from the original 83-dimensional feature set, the proposed method achieves an F1-score of 98.76%, with training times ranging from 9.65 to 13.65 seconds. These results demonstrate that the framework effectively balances detection performance and computational efficiency in distributed SDN environments. Overall, this study presents a lightweight distributed intrusion detection solution tailored to resource-constrained SDN environments.