CIDS: A Collaborative Intrusion Detection System Approach for SDN‐Based Distributed Industrial Plants

ABSTRACT Industrial countries are moving toward digitizing the manufacturing processes in their factories by integrating the expected next‐generation technologies such as software‐defined networking (SDN), cloud computing, and industrial Internet‐of‐Things (IIoT). However, developing smart factories that combine these physical and cyber components faces critical challenges, particularly regarding the efficiency and security domains. For example, Distributed Denial of Service (DDoS) attacks in industrial environments could impact the progress of the automated processes and the availability of SDN‐based networks. In this paper, we present a novel collaborative intrusion detection system (CIDS) approach for SDN‐based industrial environments that integrates edge computing techniques to enhance security and operational efficiency. Our model optimizes resource utilization across dispersed industrial sites by uniquely combining three different IDSs: centralized‐based IDS, edge‐based Anomaly IDS (AIDS), and signature‐based IDS (SIDS). The proposed approach establishes consistent, network‐wide security policies to accommodate the varying processing capabilities. Moreover, the use of edge computing techniques minimizes the overhead introduced by the SDN controller located in the cloud layer and addresses scalability challenges in large‐scale networks with heavy traffic loads. Evaluation is performed using the Mininet emulator, and the results reveal a detection accuracy of up to 98%. Furthermore, profiling outcomes of the centralized controller indicate a 50% reduction in traffic monitoring function calls, highlighting the efficiency and superiority of the proposed methodology, particularly for geographically dispersed industrial sites.