Dynamic Distillation-Aided Federated Learning for Intrusion Detection in Heterogeneous Edge Networks

Intrusion detection serves as a core technology for securing heterogeneous edge networks, including IoT, industrial edges, and 5G networks. However, existing federated learning-based intrusion detection systems suffer from environmental heterogeneity, limited sample availability, and severe class imbalance—issues that result in inefficient resource allocation and compromised detection performance against rare attacks. In this paper, we propose a novel lightweight intrusion detection model for heterogeneous edge networks, named FedNIDS-CNN, which is based on dynamic distillation-aided federated learning with a CNN backbone. In the data preprocessing phase, a two-level class balancing strategy integrating nearest-neighbor interpolation augmentation and adaptive synthetic sampling is employed to ensure distortion-free sample synthesis. For feature and model optimization, principal component analysis (PCA) is used to reduce the dimensionality of traffic features, while a lightweight 1D-CNN is adopted as the base model to alleviate computational overhead on edge devices. During federated training and knowledge aggregation, a dynamic weight distillation loss mechanism is designed to enhance the model’s ability to recognize minority-class attacks. Meanwhile, the federated framework supports client-side local training and server-side weighted soft-label aggregation, enabling effective knowledge fusion across heterogeneous models. Experimental results on the CICIDS2017 dataset demonstrate that the proposed method achieves an accuracy of 98.55% and an F1-score of 98.40%. Benefiting from the soft-label transmission and parameter-free aggregation design, the framework gets rid of the constraint of homogeneous model architecture and natively supports heterogeneous network models and edge devices with different computing capabilities. It also significantly reduces communication traffic and per-round training latency, confirming its excellent real-time performance and applicability in resource-constrained edge environments.