Lightweight Intrusion Detection in IoT via SHAP-Guided Feature Pruning and Knowledge-Distilled Kronecker Networks
Hafsa Benaddi, Mohammed Jouhari, Nouha Laamech, Anas Motii, Khalil Ibrahimi
TL;DR
IoT intrusion detection faces a clash between high accuracy and edge resource limits. The authors introduce a teacher–student framework where SHAP-guided feature pruning selects a compact input subset and a Kronecker-factorized student learns from a high-capacity teacher via knowledge distillation. On the TON_IoT dataset, the student achieves millisecond-level inference with roughly 1/250th the parameters of the teacher while maintaining macro-F1 near 0.986 and recalling all attack types, validating the effectiveness of explainability-guided pruning and structured compression for edge IDS. This approach offers a practical path to scalable, energy-efficient, on-device intrusion detection in heterogeneous IoT environments, with a clear route for robustness and cross-domain extension in future work.
Abstract
The widespread deployment of Internet of Things (IoT) devices requires intrusion detection systems (IDS) with high accuracy while operating under strict resource constraints. Conventional deep learning IDS are often too large and computationally intensive for edge deployment. We propose a lightweight IDS that combines SHAP-guided feature pruning with knowledge-distilled Kronecker networks. A high-capacity teacher model identifies the most relevant features through SHAP explanations, and a compressed student leverages Kronecker-structured layers to minimize parameters while preserving discriminative inputs. Knowledge distillation transfers softened decision boundaries from teacher to student, improving generalization under compression. Experiments on the TON\_IoT dataset show that the student is nearly three orders of magnitude smaller than the teacher yet sustains macro-F1 above 0.986 with millisecond-level inference latency. The results demonstrate that explainability-driven pruning and structured compression can jointly enable scalable, low-latency, and energy-efficient IDS for heterogeneous IoT environments.