Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Sentinel: Dynamic Knowledge Distillation for Personalized Federated Intrusion Detection in Heterogeneous IoT Networks

Gurpreet Singh, Keshav Sood, P. Rajalakshmi, Yong Xiang

TL;DR

Sentinel targets robust intrusion detection in heterogeneous IoT networks by decoupling local personalization (teacher) from global collaboration (student) via a dual-model, knowledge-distillation–driven Fed framework. It jointly optimizes a class-balanced task loss, adaptive bidirectional KD, and multi-component feature alignment, while normalizing server updates to ensure fairness and stability. Empirical results on IoTID20 and 5GNIDD show Sentinel consistently outperforms state-of-the-art FL methods, especially under extreme non-IID and class imbalance, and achieves faster convergence with reduced communication overhead. The work demonstrates practical viability for privacy-preserving, bandwidth-efficient, and robust federated IDS in real-world, resource-constrained IoT deployments.

Abstract

Federated learning (FL) offers a privacy-preserving paradigm for machine learning, but its application in intrusion detection systems (IDS) within IoT networks is challenged by severe class imbalance, non-IID data, and high communication overhead.These challenges severely degrade the performance of conventional FL methods in real-world network traffic classification. To overcome these limitations, we propose Sentinel, a personalized federated IDS (pFed-IDS) framework that incorporates a dual-model architecture on each client, consisting of a personalized teacher and a lightweight shared student model. This design effectively balances deep local adaptation with efficient global model consensus while preserving client privacy by transmitting only the compact student model, thus reducing communication costs. Sentinel integrates three key mechanisms to ensure robust performance: bidirectional knowledge distillation with adaptive temperature scaling, multi-faceted feature alignment, and class-balanced loss functions. Furthermore, the server employs normalized gradient aggregation with equal client weighting to enhance fairness and mitigate client drift. Extensive experiments on the IoTID20 and 5GNIDD benchmark datasets demonstrate that Sentinel significantly outperforms state-of-the-art federated methods, establishing a new performance benchmark, especially under extreme data heterogeneity, while maintaining communication efficiency.

Sentinel: Dynamic Knowledge Distillation for Personalized Federated Intrusion Detection in Heterogeneous IoT Networks

TL;DR

Sentinel targets robust intrusion detection in heterogeneous IoT networks by decoupling local personalization (teacher) from global collaboration (student) via a dual-model, knowledge-distillation–driven Fed framework. It jointly optimizes a class-balanced task loss, adaptive bidirectional KD, and multi-component feature alignment, while normalizing server updates to ensure fairness and stability. Empirical results on IoTID20 and 5GNIDD show Sentinel consistently outperforms state-of-the-art FL methods, especially under extreme non-IID and class imbalance, and achieves faster convergence with reduced communication overhead. The work demonstrates practical viability for privacy-preserving, bandwidth-efficient, and robust federated IDS in real-world, resource-constrained IoT deployments.

Abstract

Federated learning (FL) offers a privacy-preserving paradigm for machine learning, but its application in intrusion detection systems (IDS) within IoT networks is challenged by severe class imbalance, non-IID data, and high communication overhead.These challenges severely degrade the performance of conventional FL methods in real-world network traffic classification. To overcome these limitations, we propose Sentinel, a personalized federated IDS (pFed-IDS) framework that incorporates a dual-model architecture on each client, consisting of a personalized teacher and a lightweight shared student model. This design effectively balances deep local adaptation with efficient global model consensus while preserving client privacy by transmitting only the compact student model, thus reducing communication costs. Sentinel integrates three key mechanisms to ensure robust performance: bidirectional knowledge distillation with adaptive temperature scaling, multi-faceted feature alignment, and class-balanced loss functions. Furthermore, the server employs normalized gradient aggregation with equal client weighting to enhance fairness and mitigate client drift. Extensive experiments on the IoTID20 and 5GNIDD benchmark datasets demonstrate that Sentinel significantly outperforms state-of-the-art federated methods, establishing a new performance benchmark, especially under extreme data heterogeneity, while maintaining communication efficiency.
Paper Structure (36 sections, 18 equations, 3 figures, 7 tables, 2 algorithms)

This paper contains 36 sections, 18 equations, 3 figures, 7 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Introduction
  3. Related Work
  4. Federated learning based IDSs
  5. Design of Sentinel
  6. System Overview
  7. Client-Side Training in Sentinel: Theory and Design
  8. Class-Balanced Task Loss for Data Imbalance
  9. Adaptive Bidirectional Knowledge Distillation
  10. Temperature Scaling with Decay.
  11. Confidence-Weighted Bidirectional KD Loss.
  12. Multi-Component Feature Alignment
  13. Geometric Alignment ($\mathcal{L}_{\text{geom}}$).
  14. Directional Alignment ($\mathcal{L}_{\text{dir}}$).
  15. Structural Alignment ($\mathcal{L}_{\text{struct}}$).
  16. ...and 21 more sections

Figures (3)

  • Figure 1: High-Level architecture and workflow of the Sentinel.
  • Figure : $(a)$
  • Figure : $(a)$