Federated learning based on two-stage knowledge distillation for intrusion detection in industrial IoT

Considering that the deployment of intrusion detection systems(IDS) in industrial Internet-of-Things (IIoT) environments still faces resource constraints as well as customer data sensitivity, privacy and other challenges, this paper proposes a federated transfer learning framework based on two-stage knowledge distillation (FTKD). The FTKD approach combines personalized knowledge distillation (PKD) and adaptive progressive self-Knowledge distillation (APSKD) by designing a lightweight MA-TBCLNN model to facilitate the learning process of local model personalization. Moreover, the FTKD method adopts an aggregation strategy based on Shannon entropy and maximum mean difference (EMMD), which further improves the robustness and adaptability of the model under diverse data characteristics. To enhance privacy protection, the FTKD method uses Logits, the predicted values of local models on public datasets, as the aggregation object, and introduces the uniform perturbation mechanism to achieve differential privacy protection. The experimental results show that the FTKD method achieves greater than 97 % accuracy on both ToN-IoT and Edge-IIoTset datasets, which significantly outperforms existing federated learning methods and intrusion detection methods. © 2025 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.