Sentinel: Dynamic Knowledge Distillation for Personalized Federated Intrusion Detection in Heterogeneous IoT Networks

TL;DR

Sentinel introduces a personalized federated intrusion detection framework for IoT networks that balances local adaptation and global consensus, reducing communication costs and improving detection performance under data heterogeneity.

Contribution

The paper proposes Sentinel, a novel dual-model federated IDS with knowledge distillation and feature alignment, enhancing robustness and efficiency in heterogeneous IoT environments.

Findings

Outperforms state-of-the-art federated IDS methods on benchmark datasets.

Effectively handles data heterogeneity and class imbalance.

Reduces communication overhead through lightweight student models.

Abstract

Federated learning (FL) offers a privacy-preserving paradigm for machine learning, but its application in intrusion detection systems (IDS) within IoT networks is challenged by severe class imbalance, non-IID data, and high communication overhead.These challenges severely degrade the performance of conventional FL methods in real-world network traffic classification. To overcome these limitations, we propose Sentinel, a personalized federated IDS (pFed-IDS) framework that incorporates a dual-model architecture on each client, consisting of a personalized teacher and a lightweight shared student model. This design effectively balances deep local adaptation with efficient global model consensus while preserving client privacy by transmitting only the compact student model, thus reducing communication costs. Sentinel integrates three key mechanisms to ensure robust performance: bidirectional knowledge distillation with adaptive temperature scaling, multi-faceted feature alignment, and class-balanced loss functions. Furthermore, the server employs normalized gradient aggregation with equal client weighting to enhance fairness and mitigate client drift. Extensive experiments on the IoTID20 and 5GNIDD benchmark datasets demonstrate that Sentinel significantly outperforms state-of-the-art federated methods, establishing a new performance benchmark, especially under extreme data heterogeneity, while maintaining communication efficiency.