A contrastive learning and knowledge distillation-based framework for efficient federated intrusion detection in IoT

In the era of pervasive connectivity, the widespread deployment of Internet of Things (IoT) devices across various applications has led to a rise in malicious attacks, necessitating the development of robust network intrusion detection systems (IDS) for IoT. Traditional deep learning-based IDS are challenged by the diversity of IoT devices, resource constraints, and the non-identically and independently distributed (non-IID) nature of IoT data. To address these issues, this paper introduces two solutions: CF-IDS and KF-IDS. CF-IDS is a federated learning-based IDS designed for cloud environments, preserving data privacy and addressing non-IID challenges. It utilizes contrastive learning and clustering to create pseudo-labels for public datasets, improving cold-start performance by aligning client models in the early training process. KF-IDS, as an additional (but optional) subsequent step of CF-IDS, based on knowledge distillation and mutual information theory, provides a off-line IDS solution by distillating CF-IDS into lite models. Through local deployment on low-computational-power end devices, KF-IDS avoiding upload raw data to the cloud. Experimental evaluations on public IoT datasets demonstrate that CF-IDS achieves 80.71% accuracy in non-IID scenarios, outperforming other federated learning methods such as FedNova. KF-IDS reduces time consumption by 46.81% and memory usage by 48.30% than CF-IDS while maintaining accuracy, which emphasizes the low cost of KF-IDS, such as deployed on affordable NVIDIA Jetson Nano rather than expensive RTX 4090 or Tesla A100.