{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,6]],"date-time":"2026-04-06T10:04:33Z","timestamp":1775469873257,"version":"3.50.1"},"reference-count":52,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2025,7,19]],"date-time":"2025-07-19T00:00:00Z","timestamp":1752883200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Royal Thai Air Force Cyber Security Research Program"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Deep neural networks (DNNs) are highly effective for intrusion detection systems (IDS) due to their ability to learn complex patterns and detect potential anomalies within the systems. However, their high resource consumption requirements including memory and computation make them difficult to deploy on low-powered platforms. This study explores the possibility of using knowledge distillation (KD) to reduce constraints such as power and hardware consumption and improve real-time inference speed but maintain high detection accuracy in IDS across all attack types. The technique utilizes the transfer of knowledge from DNNs (teacher) models to more lightweight shallow neural network (student) models. KD has been proven to achieve significant parameter reduction (92\u201395%) and faster inference speed (7\u201311%) while improving overall detection performance (up to 6.12%). Experimental results on datasets such as NSL-KDD, UNSW-NB15, CIC-IDS2017, IoTID20, and UAV IDS demonstrate DNN with KD\u2019s effectiveness in achieving high accuracy, precision, F1 score, and area under the curve (AUC) metrics. These findings confirm KD\u2019s ability as a potential edge computing strategy for IoT and UAV devices, which are suitable for resource-constrained environments and lead to real-time anomaly detection for next-generation distributed systems.<\/jats:p>","DOI":"10.3390\/computers14070291","type":"journal-article","created":{"date-parts":[[2025,7,21]],"date-time":"2025-07-21T08:47:14Z","timestamp":1753087634000},"page":"291","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":13,"title":["A Lightweight Intrusion Detection System for IoT and UAV Using Deep Neural Networks with Knowledge Distillation"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9306-0920","authenticated-orcid":false,"given":"Treepop","family":"Wisanwanichthan","sequence":"first","affiliation":[{"name":"Electrical Engineering Department, Navaminda Kasatriyadhiraj Royal Air Force Academy, Saraburi 18180, Thailand"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3761-0913","authenticated-orcid":false,"given":"Mason","family":"Thammawichai","sequence":"additional","affiliation":[{"name":"Electrical Engineering Department, Navaminda Kasatriyadhiraj Royal Air Force Academy, Saraburi 18180, Thailand"}]}],"member":"1968","published-online":{"date-parts":[[2025,7,19]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s42400-019-0038-7","article-title":"Survey of intrusion detection systems: Techniques, datasets and challenges","volume":"2","author":"Khraisat","year":"2019","journal-title":"Cybersecurity"},{"key":"ref_2","first-page":"94","article-title":"Guide to intrusion detection and prevention systems (idps)","volume":"800","author":"Scarfone","year":"2007","journal-title":"NIST Spec. Publ."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Hussain, A., Sharif, H., Rehman, F., Kirn, H., Sadiq, A., Khan, M.S., Riaz, A., Ali, C.N., and Chandio, A.H. (2023, January 17\u201318). A systematic review of intrusion detection systems in internet of things using ML and DL. Proceedings of the 2023 4th International Conference on Computing, Mathematics and Engineering Technologies (iCoMET), Sukkur, Pakistan.","DOI":"10.1109\/iCoMET57998.2023.10099142"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Sommer, R., and Paxson, V. (2010, January 16\u201319). Outside the closed world: On using machine learning for network intrusion detection. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA.","DOI":"10.1109\/SP.2010.25"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1007\/s11235-018-0475-8","article-title":"A comprehensive survey on network anomaly detection","volume":"70","author":"Fernandes","year":"2019","journal-title":"Telecommun. Syst."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1016\/j.neunet.2014.09.003","article-title":"Deep learning in neural networks: An overview","volume":"61","author":"Schmidhuber","year":"2015","journal-title":"Neural Netw."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1109\/TETCI.2017.2772792","article-title":"A deep learning approach to network intrusion detection","volume":"2","author":"Shone","year":"2018","journal-title":"IEEE Trans. Emerg. Top. Comput. Intell."},{"key":"ref_9","first-page":"108","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","volume":"1","author":"Sharafaldin","year":"2018","journal-title":"ICISSp"},{"key":"ref_10","unstructured":"Hinton, G., Vinyals, O., and Dean, J. (2015). Distilling the knowledge in a neural network. arXiv."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1789","DOI":"10.1007\/s11263-021-01453-z","article-title":"Knowledge distillation: A survey","volume":"129","author":"Gou","year":"2021","journal-title":"Int. J. Comput. Vis."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"126","DOI":"10.1109\/MSP.2017.2765695","article-title":"Model compression and acceleration for deep neural networks: The principles, progress, and challenges","volume":"35","author":"Cheng","year":"2018","journal-title":"IEEE Signal Process. Mag."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Teerapittayanon, S., McDanel, B., and Kung, H.T. (2017, January 5\u20138). Distributed deep neural networks over the cloud, the edge and end devices. Proceedings of the 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), Atlanta, GA, USA.","DOI":"10.1109\/ICDCS.2017.226"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"117671","DOI":"10.1016\/j.eswa.2022.117671","article-title":"A lightweight approach for network intrusion detection in industrial cyber-physical systems based on knowledge distillation and deep metric learning","volume":"206","author":"Wang","year":"2022","journal-title":"Expert Syst. Appl."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"124965","DOI":"10.1016\/j.eswa.2024.124965","article-title":"A two stage lightweight approach for intrusion detection in Internet of Things","volume":"257","author":"Li","year":"2024","journal-title":"Expert Syst. Appl."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"112118","DOI":"10.1016\/j.asoc.2024.112118","article-title":"Lightweight intrusion detection model based on CNN and knowledge distillation","volume":"165","author":"Wang","year":"2024","journal-title":"Appl. Soft Comput."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Zhao, R., Chen, Y., Wang, Y., Shi, Y., and Xue, Z. (2021, January 14\u201323). An efficient and lightweight approach for intrusion detection based on knowledge distillation. Proceedings of the ICC 2021\u2014IEEE International Conference on Communications, Montreal, QC, Canada.","DOI":"10.1109\/ICC42927.2021.9500574"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Chen, J., Guo, Q., Fu, Z., Shang, Q., Ma, H., and Wang, N. (2023, January 18\u201323). Semi-supervised Campus Network Intrusion Detection Based on Knowledge Distillation. Proceedings of the 2023 International Joint Conference on Neural Networks (IJCNN), Gold Coast, Australia.","DOI":"10.1109\/IJCNN54540.2023.10191988"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"6438","DOI":"10.1109\/JIOT.2023.3310794","article-title":"Lkd-stnn: A lightweight malicious traffic detection method for internet of things based on knowledge distillation","volume":"11","author":"Zhu","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Ren, Y., Restivo, R.D., Tan, W., Wang, J., Liu, Y., Jiang, B., Wang, H., and Song, H. (2023). Knowledge distillation-based GPS spoofing detection for small UAV. Future Internet, 15.","DOI":"10.3390\/fi15120389"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1109\/TMLCN.2024.3360915","article-title":"Unleashing the potential of knowledge distillation for IoT traffic classification","volume":"2","author":"Abbasi","year":"2024","journal-title":"IEEE Trans. Mach. Learn. Commun. Netw."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Zhao, R., Yang, L., Wang, Y., Xue, Z., Gui, G., and Ohtsuki, T. (2022, January 16\u201320). A semi-supervised federated learning scheme via knowledge distillation for intrusion detection. Proceedings of the ICC 2022\u2014IEEE International Conference on Communications, Seoul, Republic of Korea.","DOI":"10.1109\/ICC45855.2022.9838256"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Shen, J., Yang, W., Chu, Z., Fan, J., Niyato, D., and Lam, K.Y. (2024, January 9\u201313). Effective intrusion detection in heterogeneous Internet-of-Things networks via ensemble knowledge distillation-based federated learning. Proceedings of the ICC 2024\u2014IEEE International Conference on Communications, Denver, CO, USA.","DOI":"10.1109\/ICC51166.2024.10622262"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"102807","DOI":"10.1016\/j.inffus.2024.102807","article-title":"FedKD-IDS: A robust intrusion detection system using knowledge distillation-based semi-supervised federated learning and anti-poisoning attack mechanism","volume":"117","author":"Quyen","year":"2025","journal-title":"Inf. Fusion"},{"key":"ref_25","first-page":"65","article-title":"Intrusion detection system classification using different machine learning algorithms on KDD-99 and NSL-KDD datasets-a review paper","volume":"11","author":"Ravipati","year":"2019","journal-title":"Int. J. Comput. Sci. Inf. Technol. (IJCSIT) Vol"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Ali, T., Eleyan, A., Bejaoui, T., and Al-Khalidi, M. (2024, January 28\u201330). Lightweight Intrusion Detection System with GAN-Based Knowledge Distillation. Proceedings of the 2024 International Conference on Smart Applications, Communications and Networking (SmartNets), Harrisonburg, VA, USA.","DOI":"10.1109\/SmartNets61466.2024.10577682"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"106790","DOI":"10.1109\/ACCESS.2021.3101188","article-title":"An end-to-end framework for machine learning-based network intrusion detection system","volume":"9","author":"Bertoli","year":"2021","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"6106","DOI":"10.1109\/TITS.2023.3339728","article-title":"Cyber-physical intrusion detection system for unmanned aerial vehicles","volume":"25","author":"Hassler","year":"2023","journal-title":"IEEE Trans. Intell. Transp. Syst."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"33371","DOI":"10.1109\/JIOT.2024.3426511","article-title":"Real-time collaborative intrusion detection system in uav networks using deep learning","volume":"11","author":"Hadi","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Yang, S., Zheng, X., Xu, Z., and Wang, X. (June, January 28). A lightweight approach for network intrusion detection based on self-knowledge distillation. Proceedings of the ICC 2023\u2014IEEE International Conference on Communications, Rome, Italy.","DOI":"10.1109\/ICC45041.2023.10279691"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"16912","DOI":"10.1109\/JIOT.2025.3533092","article-title":"A Novel Lightweight IoT Intrusion Detection Model Based on Self-knowledge Distillation","volume":"12","author":"Wang","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A.A. (2009, January 8\u201310). A detailed analysis of the KDD CUP 99 data set. Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"138432","DOI":"10.1109\/ACCESS.2021.3118573","article-title":"A double-layered hybrid approach for network intrusion detection system using combined naive bayes and SVM","volume":"9","author":"Wisanwanichthan","year":"2021","journal-title":"IEEE Access"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Kumar, A., Guleria, K., Chauhan, R., and Upadhyay, D. (2024, January 28\u201329). Advancing Intrusion Detection with Machine Learning: Insights from the UNSW-NB15 Dataset. Proceedings of the 2024 IEEE International Conference on Information Technology, Electronics and Intelligent Communication Systems (ICITEICS), Bangalore, India.","DOI":"10.1109\/ICITEICS61368.2024.10625148"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Arun, C.B., Anusha, M., Rao, T., Rohini, B., Gargi, N., and Kodipalli, A. (2024, January 22\u201323). Enhancing Network Intrusion Detection using Artificial Neural Networks: An Analysis of the UNSW-NB15 Dataset. Proceedings of the 2024 International Conference on Integrated Intelligence and Communication Systems (ICIICS), Kalaburagi, India.","DOI":"10.1109\/ICIICS63763.2024.10859396"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Ullah, I., and Mahmoud, Q.H. (2020, January 28\u201331). A scheme for generating a dataset for anomalous activity detection in iot networks. Proceedings of the Canadian Conference on Artificial Intelligence, Kingston, ON, Canada.","DOI":"10.1007\/978-3-030-47358-7_52"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13677-018-0123-6","article-title":"Intrusion detection systems for IoT-based smart environments: A survey","volume":"7","author":"Elrawy","year":"2018","journal-title":"J. Cloud Comput."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Bebortta, S., and Senapati, D. (2021). Empirical characterization of network traffic for reliable communication in IoT devices. Security in Cyber\u2014Physical Systems, Springer.","DOI":"10.1007\/978-3-030-67361-1_3"},{"key":"ref_40","first-page":"1561","article-title":"Uav attack dataset","volume":"167","author":"Whelan","year":"2020","journal-title":"IEEE Dataport"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Choudhary, G., Sharma, V., You, I., Yim, K., Chen, R., and Cho, J.H. (2018, January 25\u201329). Intrusion detection systems for networked unmanned aerial vehicles: A survey. Proceedings of the 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC), Limassol, Cyprus.","DOI":"10.1109\/IWCMC.2018.8450305"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Krishna, C.L., and Murphy, R.R. (2017, January 11\u201313). A review on cybersecurity vulnerabilities for unmanned aerial vehicles. Proceedings of the 2017 IEEE International Symposium on Safety, Security and Rescue Robotics (SSRR), Shanghai, China.","DOI":"10.1109\/SSRR.2017.8088163"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Attack, W., Attack, I., and Attack, B.F. (2025). Ensemble of feature augmented convolutional neural network and deep autoencoder for efficient detection of network attacks. Sci. Rep., 15.","DOI":"10.1038\/s41598-025-88243-6"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Fu, Y., Du, Y., Cao, Z., Li, Q., and Xiang, W. (2022). A deep learning model for network intrusion detection with imbalanced data. Electronics, 11.","DOI":"10.3390\/electronics11060898"},{"key":"ref_45","unstructured":"Goodfellow, I., Bengio, Y., Courville, A., and Bengio, Y. (2016). Deep Learning, MIT Press."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"497","DOI":"10.1007\/s12652-020-02014-x","article-title":"A survey of neural networks usage for intrusion detection systems","volume":"12","year":"2021","journal-title":"J. Ambient. Intell. Humaniz. Comput."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Khalaf, L.I., Alhamadani, B., Ismael, O.A., Radhi, A.A., Ahmed, S.R., and Algburi, S. (2024, January 13\u201314). Deep learning-based anomaly detection in network traffic for cyber threat identification. Proceedings of the Cognitive Models and Artificial Intelligence Conference, Prague, Czech Republic.","DOI":"10.1145\/3660853.3660932"},{"key":"ref_48","unstructured":"Kingma, D.P., and Ba, J. (2014). Adam: A method for stochastic optimization. arXiv."},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Jeong, H.J., Lee, H.J., Kim, G.N., and Choi, S.H. (2025). Self-MCKD: Enhancing the Effectiveness and Efficiency of Knowledge Transfer in Malware Classification. Electronics, 14.","DOI":"10.20944\/preprints202501.2257.v1"},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Wu, Y., Zang, Z., Zou, X., Luo, W., Bai, N., Xiang, Y., Li, W., and Dong, W. (2025). Graph attention and Kolmogorov\u2013Arnold network based smart grids intrusion detection. Sci. Rep., 15.","DOI":"10.1038\/s41598-025-88054-9"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Goldblum, M., Fowl, L., Feizi, S., and Goldstein, T. (2020, January 7\u201312). Adversarially robust distillation. Proceedings of the AAAI conference on Artificial Intelligence, New York, NY, USA.","DOI":"10.1609\/aaai.v34i04.5816"},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"727","DOI":"10.3233\/JCS-210094","article-title":"Adversarial examples for network intrusion detection systems","volume":"30","author":"Sheatsley","year":"2022","journal-title":"J. Comput. Secur."}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/7\/291\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:12:35Z","timestamp":1760033555000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/14\/7\/291"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,19]]},"references-count":52,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2025,7]]}},"alternative-id":["computers14070291"],"URL":"https:\/\/doi.org\/10.3390\/computers14070291","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,19]]}}}