LKD-STNN: A Lightweight Malicious Traffic Detection Method for Internet of Things Based on Knowledge Distillation

The purpose of malicious traffic detection and identification in the Internet of Things (IoT) is to detect the intrusion of malicious traffic within the IoT network into IoT devices. Detection and identification play a key role in ensuring the security of the IoT. At this time, great success has been achieved with deep learning in the field of malicious traffic detection and identification. However, due to resource limitations, such as computation weaknesses and low-edge network node storage capacity in the IoT, a high-complexity model based on deep learning cannot be deployed and applied. In this article, we propose a lightweight malicious traffic detection and recognition model named lightweight knowledge distillation space time neural network (LKD-STNN) based on knowledge distillation (KD) deep learning for the IoT. We use KD to build a lightweight student model by depthwise separable convolution and bidirectional long short-term memory (BiLSTM) to realize a lightweight student model and obtain multidimensional characteristic information. According to the characteristics of KD, we propose an adaptive temperature function that can adaptively and dynamically change the temperature during the process of knowledge transfer so that different softening characteristics can be obtained during the training process. Then, the weight is updated by combining loss functions to improve the performance of the student model. The experimental results show that with the publicly available malicious traffic data sets for the IoT, the ToN- IoT and IoT-23, our model not only reduces the complexity of the model and the number of model parameters to less than 1% of the teacher model but also reaches an accuracy of more than 98%, indicating that our model can be applied to the multiclassification identification of malicious traffic in the IoT.