Scholarlink

<p>As cyber threats in Internet of Things networks (IOT) continue to rise, the need for lightweight and adaptive IDS has become increasingly critical. While deep learning models have enhanced attack detection accuracy, their high computational and storage requirements make them impractical for direct deployment on resource-constrained IoT devices. Although model compression techniques help reduce computational costs, they often result in performance degradation over time. The main challenge is to design a lightweight IDS with continuous updates to improve attack detection, especially zero-day attacks, and reduce bandwidth consumption. This research introduces a two-tier IDS framework utilizing a teacher-student architecture and incremental learning. A complex teacher model, trained in the cloud, transfers knowledge to a lightweight student model deployed at the edge via knowledge distillation. To overcome the challenges of bandwidth limitations and the need for efficient model updating, two key algorithms are introduced. Adaptive-Send transmits only high-uncertainty data from the edge to the cloud, while Optimize-Weights transfers only the salient weight deltas of the student model from the cloud to the edge. Together, these algorithms not only significantly reduce bandwidth consumption but also make the model update process faster and more efficient. Experimental evaluations on the UNSW-NB15, ToN-IoT, and CSE-CIC-IDS 2018 datasets show that the proposed framework achieves a 94.36% reduction in parameter count and a 91.65% decrease in model size, while maintaining performance close to that of the teacher models, with an accuracy drop ranging from 1.1% to 6%. The Adaptive-Send algorithm reduces bandwidth consumption for data transmission from edge to cloud by an average of 90%, and the Optimize-Weights algorithm achieves up to an 85% reduction in model update transmission from cloud to edge, with only a minor drop in detection performance. Incremental learning further improves the model’s accuracy by an average of 10.67% and F1-score by 9.77% for identifying unseen attacks. These results indicate that the proposed framework provides an efficient, scalable, and adaptive intrusion detection solution for resource-constrained IoT environments.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

ATS-IDS: an adaptive teacher-student framework for lightweight IDS in IoT using incremental learning

  • 期刊论文

  • 发表日期：

    2026年1月6日

查看全文
  • Maryam Habibipour,
  • Seyed Reza Kamel Tabbakh,
  • Hossein Monshizadeh Naeen,
  • Mohammad Hossein Moattar

摘要

As cyber threats in Internet of Things networks (IOT) continue to rise, the need for lightweight and adaptive IDS has become increasingly critical. While deep learning models have enhanced attack detection accuracy, their high computational and storage requirements make them impractical for direct deployment on resource-constrained IoT devices. Although model compression techniques help reduce computational costs, they often result in performance degradation over time. The main challenge is to design a lightweight IDS with continuous updates to improve attack detection, especially zero-day attacks, and reduce bandwidth consumption. This research introduces a two-tier IDS framework utilizing a teacher-student architecture and incremental learning. A complex teacher model, trained in the cloud, transfers knowledge to a lightweight student model deployed at the edge via knowledge distillation. To overcome the challenges of bandwidth limitations and the need for efficient model updating, two key algorithms are introduced. Adaptive-Send transmits only high-uncertainty data from the edge to the cloud, while Optimize-Weights transfers only the salient weight deltas of the student model from the cloud to the edge. Together, these algorithms not only significantly reduce bandwidth consumption but also make the model update process faster and more efficient. Experimental evaluations on the UNSW-NB15, ToN-IoT, and CSE-CIC-IDS 2018 datasets show that the proposed framework achieves a 94.36% reduction in parameter count and a 91.65% decrease in model size, while maintaining performance close to that of the teacher models, with an accuracy drop ranging from 1.1% to 6%. The Adaptive-Send algorithm reduces bandwidth consumption for data transmission from edge to cloud by an average of 90%, and the Optimize-Weights algorithm achieves up to an 85% reduction in model update transmission from cloud to edge, with only a minor drop in detection performance. Incremental learning further improves the model’s accuracy by an average of 10.67% and F1-score by 9.77% for identifying unseen attacks. These results indicate that the proposed framework provides an efficient, scalable, and adaptive intrusion detection solution for resource-constrained IoT environments.