Integrated Intrusion Detection and Mitigation Framework for SDN-Based IIoT Networks Using Lightweight and Adaptive AI Techniques

Abstract

Advanced and scalable intrusion detection frameworks are in great demand for the rapid proliferation of Software-Defined Networking (SDN) in Industrial Internet of Things (IIoT) environments. Traditional methods for network anomaly detection fail to adapt to dynamic traffic patterns, handle resource-constrained edge deployments, and utilize vast amounts of unlabeled data samples. To address these limitations, we propose an integrated framework combining state-of-the-art techniques for accurate, efficient, and scalable intrusion detection in SDN-based IIoT networks. Our framework starts with domain-adapted feature extraction by the use of EfficientNet-B0, a lightweight yet powerful architecture, fine-tuned on IIoT-specific traffic data samples. Incremental learning with Elastic Weight Consolidation ensures adaptability to new intrusion patterns while preserving previously learned knowledge. SimCLR is applied to generate robust embeddings through self-supervised learning in environments where labeled data are scarce. Autoencoders detect novel patterns in anomaly detection, while XGBoost conducts precise classification of known threats. Furthermore, DQN optimizes the mitigation strategy of either flow rerouting or rate limiting in real time based on the network state. In case of edge-based deployment, Tiny-YOLO presents a lightweight model for anomaly detection that performs low latency with high accuracy. This holistic framework achieves a detection accuracy of ~96%, with a false positive rate below 3% and a latency of under 15 ms, supporting the large-scale IIoT networks of more than 10,000 nodes. Our methodology pushes forward scalability, adaptability, and robustness by unifying feature extraction, anomaly detection, classification, and mitigation process