NINMix-KD: Statistical moment matching knowledge distillation for edge resource-constrained network intrusion detection

Efficient and lightweight intrusion detection models are critical for real-time deployment on resource-constrained edge Internet of Things devices. This paper presents NINMix-KD, a lightweight knowledge distillation framework for tokenized network traffic classification. The framework is built upon a compact sequence encoder that replaces self-attention with efficient token mixing and channel mixing operations, enabling linear-time processing of variable-length traffic sequences. On this basis, a moment matching knowledge distillation strategy is introduced to transfer latent representations from the teacher to a lightweight student model by aligning first-order and second-order statistics of their embeddings. This design avoids reliance on output distribution alignment and eliminates the need for computationally expensive intermediate-layer distillation. Extensive experiments are conducted on four public benchmark edge network datasets ToNIoT, CICIoV2024, Edge-IIotset and X-IIoTID, covering IoT, IoV and IIoT scenarios. The results demonstrate that the proposed approach achieves strong performance across multiple evaluation metrics. In particular, the distilled student model attains performance comparable to the teacher while reducing model size by over 90%, highlighting the effectiveness of moment-based distillation for efficient intrusion detection. These results indicate that NINMix-KD provides a practical and scalable solution for intrusion detection in resource-constrained network environments.