Lightweight Intrusion Detection in IoT via SHAP-Guided Feature Pruning and Knowledge-Distilled Kronecker Networks

TL;DR

This paper introduces a lightweight, resource-efficient intrusion detection system for IoT devices that uses explainability-guided feature pruning and knowledge distillation with Kronecker networks, achieving high accuracy and low latency.

Contribution

It presents a novel combination of SHAP-based feature pruning and Kronecker-structured knowledge distillation for scalable IoT intrusion detection.

Findings

Student model is nearly 1000 times smaller than teacher.

Maintains macro-F1 score above 0.986.

Achieves millisecond-level inference latency.

Abstract

The widespread deployment of Internet of Things (IoT) devices requires intrusion detection systems (IDS) with high accuracy while operating under strict resource constraints. Conventional deep learning IDS are often too large and computationally intensive for edge deployment. We propose a lightweight IDS that combines SHAP-guided feature pruning with knowledge-distilled Kronecker networks. A high-capacity teacher model identifies the most relevant features through SHAP explanations, and a compressed student leverages Kronecker-structured layers to minimize parameters while preserving discriminative inputs. Knowledge distillation transfers softened decision boundaries from teacher to student, improving generalization under compression. Experiments on the TON\_IoT dataset show that the student is nearly three orders of magnitude smaller than the teacher yet sustains macro-F1 above 0.986 with millisecond-level inference latency. The results demonstrate that explainability-driven pruning and structured compression can jointly enable scalable, low-latency, and energy-efficient IDS for heterogeneous IoT environments.