Lightweight Intrusion Detection in IoT via SHAP-Guided Feature Pruning and Knowledge-Distilled Kronecker Networks

2025-12-22

AI Summary

To address the challenges of excessive model size, high inference latency, and deployment difficulty for deep learning–based intrusion detection systems (IDS) on resource-constrained IoT edge devices, this paper proposes a SHAP interpretability-driven feature pruning framework integrated with Kronecker-structured knowledge distillation. Our method jointly leverages SHAP-based feature importance analysis, sparse feature selection, lightweight network design via Kronecker-product parameterization, and soft-label knowledge distillation. Evaluated on the TON_IoT dataset, the student model achieves ~1000× compression in parameter count, attains a macro-F1 score of 0.986, and reduces single-inference latency to the millisecond level. Unlike conventional approaches, our work is the first to deeply couple model interpretability—via SHAP—with structured model compression, thereby significantly improving detection accuracy, energy efficiency, and scalability for edge deployment.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Data Mining & Knowledge Management: Data Compression
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Web Mining and Content Analysis: Large pretrained models with web data
• Security and Privacy: Large-scale security measurements

Abstract

The widespread deployment of Internet of Things (IoT) devices requires intrusion detection systems (IDS) with high accuracy while operating under strict resource constraints. Conventional deep learning IDS are often too large and computationally intensive for edge deployment. We propose a lightweight IDS that combines SHAP-guided feature pruning with knowledge-distilled Kronecker networks. A high-capacity teacher model identifies the most relevant features through SHAP explanations, and a compressed student leverages Kronecker-structured layers to minimize parameters while preserving discriminative inputs. Knowledge distillation transfers softened decision boundaries from teacher to student, improving generalization under compression. Experiments on the TON_IoT dataset show that the student is nearly three orders of magnitude smaller than the teacher yet sustains macro-F1 above 0.986 with millisecond-level inference latency. The results demonstrate that explainability-driven pruning and structured compression can jointly enable scalable, low-latency, and energy-efficient IDS for heterogeneous IoT environments.

Problem

• Develop lightweight intrusion detection for IoT devices
• Reduce model size and computational cost for edge deployment
• Maintain high detection accuracy under resource constraints

Innovation

• SHAP-guided feature pruning for relevance identification
• Kronecker-structured layers for parameter minimization
• Knowledge distillation for improved generalization under compression