Constraint-Aware Layered Knowledge Distillation for Lightweight Anomaly Detection in Power Industrial Control Networks

With the proliferation of intelligent substations and the increasing prevalence of cyber threats such as false data injection and denial-of-service attacks, efficient and reliable anomaly detection in power industrial control networks (ICNs) has become a critical challenge. However, the stringent resource constraints of edge devices such as intelligent electronic devices (IEDs) and protection terminals impose severe limitations on deploying high-capacity deep learning models. To address this problem, we propose a constraint-aware layered distillation (CALD) framework that enables the construction of lightweight and high-performance anomaly detectors tailored for real-time deployment in power ICNs. Our method integrates global soft-label distillation and targeted feature alignment, which jointly preserve decision-level knowledge and fine-grained temporal-spatial representations for anomaly detection, while explicitly incorporating inference latency and memory footprint into the optimization objective. Extensive experiments on realistic power grid traffic datasets demonstrate that CALD achieves comparable detection accuracy to state-of-the-art teacher models, with up to 20-fold reduction in model size and sub-4ms inference latency, while outperforming representative lightweight baselines such as MobileNet and TinyCNN by 4.3–6.7% in F1-score. The proposed framework offers deployment-ready, resource-efficient, and trustworthy edge intelligence for digital substations and broader industrial control applications.