Abstract
Software-defined networking (SDN) is increasingly deployed in industrial networks such as industrial Internet of Things and cloud-edge control systems, where centralized controllers, open southbound interfaces, and dynamic flow-table mechanisms enlarge the attack surface. Traditional centralized intrusion detection systems require raw-traffic uploads, impose heavy controller load, risk cross-domain privacy leakage, and generalize poorly under non-IID traffic across industrial subdomains. This paper proposes a scalable distributed intrusion detection and privacy-preserving data fusion mechanism for SDN-based industrial networks. The system deploys local SDN controllers, edge intrusion detection agents, a secure aggregation module, and a global federated fusion server, fusing data-plane traffic, control-plane event, and temporal behavior features through federated learning, secure aggregation, and differential privacy perturbation for cross-domain collaborative detection without exposing raw industrial traffic. Simulations using InSDN, CICIDS2017, and Mininet-generated industrial SDN attack traffic show accuracy of 0.958, an F1-score of 0.949, and an AUC of 0.974 in multi-class classification. As SDN domains grow from 5 to 50, the F1-score decreases only from 0.953 to 0.941 while detection latency rises from 18.4 ms to 41.6 ms. At a privacy budget of 2.0, the success rate of membership inference attacks falls to 0.587, a 28.1% reduction relative to the non-differential-privacy setting. These results show that the method enables scalable, low-overhead, interpretable collaborative intrusion detection for industrial SDN networks without sharing raw traffic, offering a practical solution for privacy-preserving security monitoring in large-scale industrial information systems.