SGKD-FedIDS: Space–Ground Knowledge Distillation for Lightweight Federated Intrusion Detection in Satellite Internet

Satellite intrusion detection is challenged by limited on-board resources, heterogeneous traffic, and intermittent satellite–ground links. We propose a space–ground knowledge-distillation-based federated intrusion detection system (SGKD-FedIDS) that transfers attack-discriminative knowledge from a high-capacity ground teacher to a lightweight satellite student. Satellite clients adapt the student to local traffic and upload compressed model updates. The ground federated server aggregates available updates asynchronously and downweights stale ones, avoiding the need to wait for all clients. Experiments across three intrusion detection datasets show that the distilled student achieves an F1-score of 0.9348 on UNSW-NB15, while lightweight federated updating reduces uploaded communication cost by approximately 86.9%. These results support efficient satellite intrusion detection under resource and connectivity constraints.