A temperature-adaptive logit-standardized knowledge distillation for lightweight network intrusion detection

The rapid growth of the Internet has made network attacks increasingly frequent, stealthy, and diverse, posing stringent requirements on the accuracy and latency of network intrusion detection systems (NIDS). Although deep-learning-based NIDS can achieve strong detection performance, their large parameter size and high computational cost hinder deployment on resource-constrained edge devices. To address this limitation, we propose a temperature-adaptive logit-standardized knowledge distillation framework for lightweight network intrusion detection. A high-capacity teacher network first learns discriminative representations from network traffic, and a compact student network is then trained to mimic the teacher under a tailored distillation scheme. During distillation, we apply per-sample Z-score standardization to the logits of both teacher and student models to mitigate scale mismatch and emphasize relative inter-class relationships. Moreover, we adapt the distillation temperature according to sample difficulty and training progress, enabling suitably smoothed soft targets across samples and stages, and jointly optimize the student with hard-label supervision. Experiments on benchmark datasets including NSL-KDD and CIC-IDS2017 demonstrate that the proposed method substantially reduces model complexity while maintaining stable and competitive detection performance. Additional repeated-run, ablation, and lightweight baseline analyses further indicate that the proposed framework achieves a favorable accuracy-complexity trade-off.