Knowledge distillation-based Multi-Optimization intrusion detection system

Haofan Wang

doi:10.1016/j.future.2025.108296

2025-12-31

PRE

Haofan Wang

Farah Kandah

DOI：10.1016/j.future.2025.108296

原文链接

原文求助

摘要

En 中文

Network attacks have expanded in scope, increased in frequency, and evolved in many ways in recent years. Internet of Things (IoT) devices, due to their limited computational resources, massive deployment, direct exposure to the public Internet, and lack of maintenance, face even more severe threat landscapes. Nowadays, numerous lightweight methods have been proposed, but they all rely on single-perspective optimizations, making it difficult to achieve an optimal balance between performance and computational resource consumption. In this work, we proposed a Knowledge Distillation-based Multi-Optimization Intrusion Detection System (KDMO-IDS) that reduces resource consumption at the feature, sample, and model levels. At the feature level, we compute the Analysis of Variance (ANOVA) F-value for each feature to rank them and determine the optimal subset. At the sample level, we use MiniBatchKMeans with Medoid clustering to compress data under preset ratios At the model level, we combine knowledge distillation with attention transfer so that a compact student model retains the performance of its teacher, further optimized by block operator fusion, pruning, and early stopping. We conduct extensive ablation studies to validate the contribution of each component. Experiments on WUSTL-IIoT and X-IIoTID datasets show that our proposed KDMO-IDS demonstrates superior performance and exhibits strong lightweight characteristics and generalizability compare to existing baseline models, making it well-suited for seamless integration into edge-cloud and distributed computing environments and providing a scalable security solution for next-generation high-performance IoT systems.