HAKD: Hierarchically Adaptive Knowledge Distillation for Robust Federated Intrusion Detection in Connected Vehicles

ABSTRACT Secure and privacy‐preserving intrusion detection is paramount for the expanding ecosystem of Connected and Automated Vehicles (CAVs). While Federated Learning (FL) offers a promising solution by enabling collaborative training without data sharing, its practical deployment is severely hampered by statistical heterogeneity, specifically disparate label distributions and extreme variations in local sample sizes across vehicle fleets. To overcome these hurdles, we propose Hierarchically Adaptive Knowledge Distillation (HAKD), a server‐side framework that aggregates heterogeneous client models into a robust global student. HAKD uniquely integrates output‐level ensemble distillation with feature‐level attention transfer, performing all computationally intensive fusion operations on the server to respect in‐vehicle resource constraints. Central to this approach is a statistically principled, data‐driven weighting mechanism that utilizes Tikhonov‐regularized Inverse Error Covariance (IEC) to dynamically calibrate the contribution of intermediate layer representations. A variance‐aware convergence analysis demonstrates that this layer‐adaptive weighting strategy minimizes the attention‐induced quadratic surrogate, theoretically ensuring a faster approach to stationary points. We validate HAKD using the CIC‐DDoS2019 benchmark under rigorous non‐IID conditions, including Dirichlet‐based label partitioning and extreme client imbalance ratios. Experimental results confirm that HAKD achieves consistently superior detection F1 scores compared to standard FedAvg and state‐of‐the‐art distillation baselines. Notably, the method exhibits markedly faster empirical convergence without incurring additional communication overheads for the client nodes. These findings establish HAKD as a scalable and resilient solution for vehicular security, effectively bridging the gap between theoretical FL optimization and practical, resource‐constrained deployment.