Hybrid Distributed Learning With Knowledge Distillation for Resource-Efficient Intrusion Detection in Distributed Networks

Abstract

The rapid evolution of telecommunications has increased network complexity and driven a shift toward decentralized architectures. While this shift introduces new landscapes and opportunities, it also enlarges the attack surface, highlighting the need for adaptive and scalable network security. In this context, artificial intelligence-based network intrusion detection systems (AI-NIDSs) have been extensively investigated to counter the increasing scale and complexity of network threats. Recently, to enable network threat detection in distributed environments, decentralized learning approaches such as federated learning (FL) and split learning (SL) have been actively explored. However, existing approaches impose substantial computational burdens on resource-constrained nodes and manifest inefficiencies in the learning process, which can lead to unstable convergence and noticeable performance degradation. In this article, we propose a novel AI-driven distributed NIDS that considers the computing capabilities of resource-constrained nodes while enabling efficient learning in distributed environments. To address the above challenges, we leverage the split-FL framework and incorporate a knowledge distillation (KD) strategy, with consideration for the objectives of proactive real-time intrusion detection at the network edge. Experiments on a 5G network dataset and an Open RAN dataset demonstrate that the proposed framework can achieve accuracy comparable to a centralized model while reducing local computational overhead and maintaining stable convergence under realistic data distribution scenarios.