Federated Evolutionary Knowledge Distillation for IoT Intrusion Detection

With the rapid development of the Internet of Things (IoT), network security faces increasingly severe challenges.Existing intrusion detection approaches based on federated knowledge distillation (such as FedKD, FedDF, and FedMD) generally rely on static or unidirectional knowledge transfer paradigms, where the teacher model remains fixed.Consequently, these methods struggle to adapt to dynamically evolving attack patterns in IoT environments.To address this limitation, we propose FedEKD (Federated Evolutionary Knowledge Distillation), an intrusion detection model that integrates evolutionary distillation with federated learning.FedEKD employs a bidirectional optimization strategy combining a dynamic aggregation mechanism and evolutionary distillation to enhance anomaly detection performance while maintaining model lightness.Furthermore, we introduce GSDA (Gradient Sparsity and Data Volume-based Aggregation), an aggregation algorithm designed to mitigate client heterogeneity across IoT edge devices by leveraging gradient sparsity and data volume.Experiments conducted on three IoT intrusion detection datasets-NSL-KDD, CICIDS2017, and UNSW-NB15-demonstrate the superior performance of our approach.Under a threeclient configuration, FedEKD achieves average accuracies of 98.46%, 99.59%, and 92.94%, respectively, surpassing traditional federated learning methods by 0.72%-5.75%.With six clients, the performance further improves to 98.62%, 99.63%, and 93.55%, while reducing communication overhead by over 30% on average.These results confirm that FedEKD offers superior detection accuracy and deployment efficiency in IoT environments, particularly in identifying previously unseen attacks.