Lightweight Intrusion Detection Model Using Adaptive Knowledge Distillation

Abstract

To address the trade-off between detection accuracy and computational overhead in network intrusion detection systems within resource-constrained environments, this paper proposes a lightweight model based on adaptive knowledge distillation. Traditional knowledge distillation methods often exhibit low knowledge transfer efficiency and insufficient learning of hard samples when processing network traffic data. The proposed model achieves collaborative optimization of lightweight architecture and detection performance through two core mechanisms. First, a dynamic weight allocation strategy based on the Euclidean distance between teacher and student model outputs is designed to adaptively adjust the weights of soft targets and hard labels in the loss function, thereby enhancing the stability of knowledge transfer. Second, Focal Loss is introduced to strengthen the model's ability to learn hard samples, improving the recognition of complex attack patterns and rare threats. Experimental results on the NSL-KDD dataset demonstrate that the proposed method, while compressing the model parameters by nearly two orders of magnitude, still outperforms traditional knowledge distillation methods in detection performance, providing a feasible technical pathway for efficient intrusion detection in resource-constrained environments.