A temperature-adaptive logit-standardized knowledge distillation for lightweight network intrusion detection
- 1School of Computer, Xijing University, Xi'an, Shaanxi, China.
- 2Xi'an Key Laboratory of Human-Machine Integration and Control Technology for Intelligent Rehabilitation, School of Computer Science, Xijing University, Xi'an, Shaanxi, China.
Abstract
The rapid growth of the Internet has made network attacks increasingly frequent, stealthy, and diverse, posing stringent requirements on the accuracy and latency of network intrusion detection systems (NIDS). Although deep-learning-based NIDS can achieve strong detection performance, their large parameter size and high computational cost hinder deployment on resource-constrained edge devices. To address this limitation, we propose a temperature-adaptive logit-standardized knowledge distillation framework for lightweight network intrusion detection. A high-capacity teacher network first learns discriminative representations from network traffic, and a compact student network is then trained to mimic the teacher under a tailored distillation scheme. During distillation, we apply per-sample Z-score standardization to the logits of both teacher and student models to mitigate scale mismatch and emphasize relative inter-class relationships. Moreover, we adapt the distillation temperature according to sample difficulty and training progress, enabling suitably smoothed soft targets across samples and stages, and jointly optimize the student with hard-label supervision. Experiments on benchmark datasets including NSL-KDD and CIC-IDS2017 demonstrate that the proposed method substantially reduces model complexity while maintaining stable and competitive detection performance. Additional repeated-run, ablation, and lightweight baseline analyses further indicate that the proposed framework achieves a favorable accuracy–complexity trade-off.
Related
- GT-PNID: A lightweight graph-temporal network integrating GCN and transformer for power network intrusion detection
- An adaptive transformer-based model with entropy-driven knowledge distillation for single-channel EEG REM sleep detection
- Improved vision transformer for sports image classification via transfer learning and knowledge distillation
- Relational Knowledge Distillation Brings DNN Representations Close Enough to Humans to Be Aligned Without Supervision
- GFLNet: A lightweight real-time detector with knowledge-guided compression in remote sensing images
BibTeX
@article{dong2026temperatureadaptive,
title = {{A temperature-adaptive logit-standardized knowledge distillation for lightweight network intrusion detection}},
author = {XiaoFang Dong and Kai Yang and JingChao Liu and Wen Chen},
journal = {PLOS One},
year = {2026},
month = nov,
doi = {10.1371/journal.pone.0361860},
url = {https://doi.org/10.1371/journal.pone.0361860},
note = {CC BY},
}
RIS
TY - JOUR
TI - A temperature-adaptive logit-standardized knowledge distillation for lightweight network intrusion detection
AU - XiaoFang Dong
AU - Kai Yang
AU - JingChao Liu
AU - Wen Chen
PY - 2026
DA - 2026/11/02
JO - PLOS One
DO - 10.1371/journal.pone.0361860
UR - https://doi.org/10.1371/journal.pone.0361860
AB - The rapid growth of the Internet has made network attacks increasingly frequent, stealthy, and diverse, posing stringent requirements on the accuracy and latency of network intrusion detection systems (NIDS). Although deep-learning-based NIDS can achieve strong detection performance, their large parameter size and high computational cost hinder deployment on resource-constrained edge devices. To address this limitation, we propose a temperature-adaptive logit-standardized knowledge distillation framework for lightweight network intrusion detection. A high-capacity teacher network first learns discriminative representations from network traffic, and a compact student network is then trained to mimic the teacher under a tailored distillation scheme. During distillation, we apply per-sample Z-score standardization to the logits of both teacher and student models to mitigate scale mismatch and emphasize relative inter-class relationships. Moreover, we adapt the distillation temperature according to sample difficulty and training progress, enabling suitably smoothed soft targets across samples and stages, and jointly optimize the student with hard-label supervision. Experiments on benchmark datasets including NSL-KDD and CIC-IDS2017 demonstrate that the proposed method substantially reduces model complexity while maintaining stable and competitive detection performance. Additional repeated-run, ablation, and lightweight baseline analyses further indicate that the proposed framework achieves a favorable accuracy–complexity trade-off.
SN - 1932-6203
ER -