AnDO: A Lightweight Feature Extraction Framework for IDS Modelling in Low-Resource Software-Defined Networks

Ackerson, Emmanuel and Chavula, Josiah (2026) AnDO: A Lightweight Feature Extraction Framework for IDS Modelling in Low-Resource Software-Defined Networks, Annual Research Conference of South African Institute of Computer Scientists and Information Technologists (SAICSIT 2026), 13-16 July 2026, Cape Town, South Africa, Springer Nature Computer Science book series (CCIS, LNAI, LNBI, NBIP or LNCS), Springer Series.

Text AnDO.pdf - Accepted Version Download (896kB)

Abstract

Network traffic features serve as predictor variables for machine learning-based intrusion detection systems (ML-IDS), yet practical deployment is often hindered by computational overhead and latency introduced during capture and extraction. While benchmark datasets like UNSW-NB15 and InSDN have accelerated IDS research through pre-engineered features, they exhibit limited generalization in live or heterogeneous environments. Critically, SDN-oriented datasets omit architecture-intrinsic attributes such as control-plane state, data-plane interactions, and flow-rule dynamics essential for accurately modeling SDN behavior. This paper proposes AnDO, an efficient real-time feature extraction framework for low-resource Software-Defined Networking environments. AnDO implements an end-to-end extraction pipeline directly within the live network, eliminating external database dependencies. The architecture integrates Argus for flow generation, nDPI for protocol classification, and ONOS control-plane intelligence, augmented by a custom sliding-window connection-tracking engine for contextual flow statistics. By fusing packet-level metrics, protocol labels, and SDN state information, AnDO extracts 50 per-flow features under a linear computational model. Experimental evaluation in a virtualized SDN testbed demonstrates predictable scalability, stable resource utilization, and bounded overhead. These results validate AnDO as an efficient, resource-aware feature extraction framework suitable for constrained and community-oriented network environments.

Item Type:	Conference proceedings
Uncontrolled Keywords:	Feature extraction, SDN-Specific Features, ONOS Controller, Machine-Learning IDS, AnDO framework, Network Traffic, Software-Defined Networking, Low-Resource CWNs, lightweight feature extraction framework.
Subjects:	Security and privacy > Intrusion/anomaly detection and malware mitigation Networks > Network properties > Network security
Date Deposited:	27 Jul 2026 07:45
Last Modified:	27 Jul 2026 07:45
URI:	https://pubs.cs.uct.ac.za/id/eprint/1790

Actions (login required)

View Item