Lightweight Intrusion Detection in IoT via SHAP-Guided Feature Pruning and Knowledge-Distilled Kronecker Networks
This work addresses the need for scalable, low-latency, and energy-efficient IDS in heterogeneous IoT environments, representing an incremental improvement through hybrid techniques.
The paper tackled the problem of deploying intrusion detection systems (IDS) on resource-constrained IoT devices by proposing a lightweight method that combines SHAP-guided feature pruning and knowledge-distilled Kronecker networks, resulting in a student model nearly three orders of magnitude smaller than the teacher while sustaining macro-F1 above 0.986 with millisecond-level inference latency.
The widespread deployment of Internet of Things (IoT) devices requires intrusion detection systems (IDS) with high accuracy while operating under strict resource constraints. Conventional deep learning IDS are often too large and computationally intensive for edge deployment. We propose a lightweight IDS that combines SHAP-guided feature pruning with knowledge-distilled Kronecker networks. A high-capacity teacher model identifies the most relevant features through SHAP explanations, and a compressed student leverages Kronecker-structured layers to minimize parameters while preserving discriminative inputs. Knowledge distillation transfers softened decision boundaries from teacher to student, improving generalization under compression. Experiments on the TON\_IoT dataset show that the student is nearly three orders of magnitude smaller than the teacher yet sustains macro-F1 above 0.986 with millisecond-level inference latency. The results demonstrate that explainability-driven pruning and structured compression can jointly enable scalable, low-latency, and energy-efficient IDS for heterogeneous IoT environments.