Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity

Muhammet Anil Yagiz, Polat Goktas

TL;DR

LENS-XAI tackles the need for scalable, interpretable intrusion detection in IIoT/edge contexts by uniting a variational autoencoder (VAE)–based latent representation with knowledge distillation (KD) to craft a lightweight yet accurate student model guided by a high-capacity teacher. An attribution-based explainability component decomposes predictions into feature-level contributions, enabling transparent decision-making. The framework is validated across four diverse benchmarks (Edge-IIoTset, UKM-IDS20, CTU-13, NSL-KDD), achieving high detection accuracies (up to 99.92% on UKM-IDS20 and 98.66% on NSL-KDD for the teacher, 99.80% for the student) while substantially reducing model complexity and inference time. The results demonstrate robust performance, strong generalization to varied attack types, and enhanced trust via interpretable explanations, making LENS-XAI suitable for real-world deployment in resource-constrained environments. Future work suggests extending the framework to ensemble/distributed settings to further improve robustness and adaptability in evolving threat landscapes.

Abstract

The rapid proliferation of Industrial Internet of Things (IIoT) systems necessitates advanced, interpretable, and scalable intrusion detection systems (IDS) to combat emerging cyber threats. Traditional IDS face challenges such as high computational demands, limited explainability, and inflexibility against evolving attack patterns. To address these limitations, this study introduces the Lightweight Explainable Network Security framework (LENS-XAI), which combines robust intrusion detection with enhanced interpretability and scalability. LENS-XAI integrates knowledge distillation, variational autoencoder models, and attribution-based explainability techniques to achieve high detection accuracy and transparency in decision-making. By leveraging a training set comprising 10% of the available data, the framework optimizes computational efficiency without sacrificing performance. Experimental evaluation on four benchmark datasets: Edge-IIoTset, UKM-IDS20, CTU-13, and NSL-KDD, demonstrates the framework's superior performance, achieving detection accuracies of 95.34%, 99.92%, 98.42%, and 99.34%, respectively. Additionally, the framework excels in reducing false positives and adapting to complex attack scenarios, outperforming existing state-of-the-art methods. Key strengths of LENS-XAI include its lightweight design, suitable for resource-constrained environments, and its scalability across diverse IIoT and cybersecurity contexts. Moreover, the explainability module enhances trust and transparency, critical for practical deployment in dynamic and sensitive applications. This research contributes significantly to advancing IDS by addressing computational efficiency, feature interpretability, and real-world applicability. Future work could focus on extending the framework to ensemble AI systems for distributed environments, further enhancing its robustness and adaptability.

LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity

TL;DR

LENS-XAI tackles the need for scalable, interpretable intrusion detection in IIoT/edge contexts by uniting a variational autoencoder (VAE)–based latent representation with knowledge distillation (KD) to craft a lightweight yet accurate student model guided by a high-capacity teacher. An attribution-based explainability component decomposes predictions into feature-level contributions, enabling transparent decision-making. The framework is validated across four diverse benchmarks (Edge-IIoTset, UKM-IDS20, CTU-13, NSL-KDD), achieving high detection accuracies (up to 99.92% on UKM-IDS20 and 98.66% on NSL-KDD for the teacher, 99.80% for the student) while substantially reducing model complexity and inference time. The results demonstrate robust performance, strong generalization to varied attack types, and enhanced trust via interpretable explanations, making LENS-XAI suitable for real-world deployment in resource-constrained environments. Future work suggests extending the framework to ensemble/distributed settings to further improve robustness and adaptability in evolving threat landscapes.

Abstract

The rapid proliferation of Industrial Internet of Things (IIoT) systems necessitates advanced, interpretable, and scalable intrusion detection systems (IDS) to combat emerging cyber threats. Traditional IDS face challenges such as high computational demands, limited explainability, and inflexibility against evolving attack patterns. To address these limitations, this study introduces the Lightweight Explainable Network Security framework (LENS-XAI), which combines robust intrusion detection with enhanced interpretability and scalability. LENS-XAI integrates knowledge distillation, variational autoencoder models, and attribution-based explainability techniques to achieve high detection accuracy and transparency in decision-making. By leveraging a training set comprising 10% of the available data, the framework optimizes computational efficiency without sacrificing performance. Experimental evaluation on four benchmark datasets: Edge-IIoTset, UKM-IDS20, CTU-13, and NSL-KDD, demonstrates the framework's superior performance, achieving detection accuracies of 95.34%, 99.92%, 98.42%, and 99.34%, respectively. Additionally, the framework excels in reducing false positives and adapting to complex attack scenarios, outperforming existing state-of-the-art methods. Key strengths of LENS-XAI include its lightweight design, suitable for resource-constrained environments, and its scalability across diverse IIoT and cybersecurity contexts. Moreover, the explainability module enhances trust and transparency, critical for practical deployment in dynamic and sensitive applications. This research contributes significantly to advancing IDS by addressing computational efficiency, feature interpretability, and real-world applicability. Future work could focus on extending the framework to ensemble AI systems for distributed environments, further enhancing its robustness and adaptability.
Paper Structure (71 sections, 8 equations, 9 figures, 13 tables, 2 algorithms)

This paper contains 71 sections, 8 equations, 9 figures, 13 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Literature survey
  3. Explainable Deep Learning Approaches for IDS
  4. Lightweight and Scalable Models
  5. Advanced Anomaly Detection Techniques
  6. Knowledge Distillation & VAEs
  7. Research Gap
  8. Problem Statement and Motivation
  9. Methodology
  10. Framework Overview
  11. Data Preprocessing and Feature Engineering
  12. Missing Value Handling
  13. Feature Encoding and Transformation
  14. Standardization
  15. Representation Learning with Variational Autoencoders
  16. ...and 56 more sections

Figures (9)

  • Figure 1: Class distribution of Edge-IIoTset dataset.
  • Figure 2: Class distribution of UKM20 dataset.
  • Figure 3: Class distribution of NSL-KDD dataset.
  • Figure 4: Confusion matrices of the LENS-XAI framework on the Edge-IIoTSet dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between 15 classes.
  • Figure 5: Confusion matrices of the LENS-XAI framework on the UKM IDS20 dataset: (Left) Teacher and (Right) Student models, showcasing effective differentiation between eight classes.
  • ...and 4 more figures