Lightweight Identification of Malicious IoT Traffic via Cross-View Knowledge Distillation
Abstract
Accurately identifying malicious traffic in heterogeneous IoT environments is critical for network security. Although deep learning-based methods can effectively extract multi-dimensional features and achieve high accuracy, deploying complex models on resource-constrained IoT devices remains challenging. To balance performance and efficiency, we propose IoT-CVKD, a novel malicious IoT traffic identification framework leveraging cross-view knowledge distillation. IoT-CVKD consists of a multi-view teacher model and a lightweight single-view student model. The teacher model characterizes heterogeneous traffic from different perspectives by capturing flow-level global and packet-level spatio-temporal local burst information, and efficiently fuses these features using a cross-attention mechanism. The student model, composed of lightweight and computationally efficient modules, takes only packet-level features as input. Multi-view knowledge from the teacher is then implicitly distilled into the student through cross-view knowledge distillation during training, thereby significantly enhancing the student’s classification capability. Extensive evaluations demonstrate that IoT-CVKD achieves superior classification performance compared to state-of-the-art methods while substantially reducing computational complexity, making it highly suitable for resource-constrained IoT deployments.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Cross-view distillation in IoT traffic analysis achieves 92-95% parameter reduction while sustaining macro-F1 above 0.986.
“cross-view distillation in IoT traffic analysis achieves 92-95% parameter reduction while sustaining macro-F1 above 0.986”
From Agentic AI and Large Language Models for Autonomous IoT Cybersecurity: A Systematic Survey, Taxonomy, and Research Roadmap (2026) · cites this paper as [82]
Cites
Distilling the Knowledge in a Neural Network
Hinton, G., Vinyals, O., & Dean, J. (2015) · arXiv · doi:10.48550/arxiv.1503.02531 · Cited by 14,204 · see citing works
ShuffleNet: An Extremely Efficient Convolutional Neural Network for Mobile Devices
Zhang, X., Zhou, X., Lin, M., & Sun, J. (2018) · 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition · doi:10.1109/cvpr.2018.00716 · Cited by 9,982 · see citing works
Multi-view learning overview: Recent progress and new challenges
Zhao, J., Xie, X., Xu, X., & Sun, S. (2017) · Information Fusion · doi:10.1016/j.inffus.2017.02.007 · Cited by 1,002 · see citing works
Toward the Accurate Identification of Network Applications
Moore, A. W., & Papagiannaki, K. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31966-5_4 · Cited by 801 · see citing works
Moustafa, N. (2021) · Sustainable Cities and Society · doi:10.1016/j.scs.2021.102994 · Cited by 747 · see citing works
Deep Learning for Encrypted Traffic Classification: An Overview
Rezaei, S., & Liu, X. (2019) · IEEE Communications Magazine · doi:10.1109/mcom.2019.1800819 · Cited by 670 · see citing works
Website Fingerprinting at Internet Scale
Panchenko, A., Lanze, F., Zinnen, A., Henze, M., Pennekamp, J., Wehrle, K., & Engel, T. (2016) · Proceedings 2016 Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23477 · Cited by 645 · see citing works
FS-Net: A Flow Sequence Network For Encrypted Traffic Classification
Liu, C., He, L., Xiong, G., Cao, Z., & Li, Z. (2019) · IEEE INFOCOM 2019 - IEEE Conference on Computer Communications · doi:10.1109/infocom.2019.8737507 · Cited by 630 · see citing works
Moustafa, N., Turnbull, B., & Choo, K. R. (2018) · IEEE Internet of Things Journal · doi:10.1109/jiot.2018.2871719 · Cited by 597 · see citing works
Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning
Sirinam, P., Imani, M., Juarez, M., & Wright, M. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243768 · Cited by 592 · see citing works
Shafiq, M., Tian, Z., Bashir, A. K., Du, X., & Guizani, M. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3002255 · Cited by 555 · see citing works
AppScanner: Automatic Fingerprinting of Smartphone Apps from Encrypted Network Traffic
Taylor, V. F., Spolaor, R., Conti, M., & Martinović, I. (2016) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp.2016.40 · Cited by 420 · see citing works
A hybrid CNN+LSTM-based intrusion detection system for industrial IoT networks
Altunay, H. C., & Albayrak, Z. (2023) · Engineering Science and Technology an International Journal · doi:10.1016/j.jestch.2022.101322 · Cited by 393 · see citing works
Pacheco, F., Expósito, E., Gineste, M., Baudoin, C., & Aguilar, J. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2883147 · Cited by 371 · see citing works
Detecting Internet of Things attacks using distributed deep learning
Parra, G. D. L. T., Rad, P., Choo, K. R., & Beebe, N. L. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102662 · Cited by 337 · see citing works
A Survey on Encrypted Network Traffic Analysis Applications, Techniques, and Countermeasures
Papadogiannaki, E., & Ioannidis, S. (2021) · ACM Computing Surveys · doi:10.1145/3457904 · Cited by 297 · see citing works
Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey
Shen, M., Ye, K., Liu, X., Zhu, L., Kang, J., Yu, S., Li, Q. L., & Xu, K. (2022) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2022.3208196 · Cited by 286 · see citing works
Edge Intelligence: Empowering Intelligence to the Edge of Network
Xu, D., Li, T., Li, Y., Su, X. J., Tarkoma, S., Jiang, T., Crowcroft, J., & Hui, P. (2021) · Proceedings of the IEEE · doi:10.1109/jproc.2021.3119950 · Cited by 281 · see citing works
Industrial Internet of Things Intelligence Empowering Smart Manufacturing: A Literature Review
Hu, Y., Jia, Q., Yao, Y., Lee, Y., Lee, M., Wang, C., Zhou, X., Xie, R., & Yu, F. R. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2024.3367692 · Cited by 281 · see citing works
The rise of traffic classification in IoT networks: A survey
Tahaei, H., Afifi, F., Asemi, A., Zaki, F., & Anuar, N. B. (2020) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2020.102538 · Cited by 278 · see citing works
Anomaly based network intrusion detection for IoT attacks using deep learning technique
Sharma, B. L., Sharma, L., Lal, C., & Roy, S. (2023) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2023.108626 · Cited by 267 · see citing works
Datanet: Deep Learning Based Encrypted Network Traffic Classification in SDN Home Gateway
Wang, P., Ye, F., Chen, X., & Qian, Y. (2018) · IEEE Access · doi:10.1109/access.2018.2872430 · Cited by 257 · see citing works
Deep learning enabled intrusion detection system for Industrial IOT environment
Nandanwar, H., & Katarya, R. (2024) · Expert Systems with Applications · doi:10.1016/j.eswa.2024.123808 · Cited by 251 · see citing works
A Novel Intrusion Detection Method Based on Lightweight Neural Network for Internet of Things
Zhao, R., Gui, G., Xue, Z., Yin, J., Ohtsuki, T. O., Adebisi, B., & Gacanin, H. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3119055 · Cited by 230 · see citing works
Squeezing Deep Learning into Mobile and Embedded Devices
Lane, N. D., Bhattacharya, S., Mathur, A., Georgiev, P., Forlivesi, C., & Kawsar, F. (2017) · IEEE Pervasive Computing · doi:10.1109/mprv.2017.2940968 · Cited by 224 · see citing works
Machine Learning Based IoT Intrusion Detection System: An MQTT Case Study (MQTT-IoT-IDS2020 Dataset)
Hindy, H., Bayne, E., Bureš, M., Atkinson, R. C., Tachtatzis, C., & Bellekens, X. (2021) · Lecture notes in networks and systems · doi:10.1007/978-3-030-64758-2_6 · Cited by 199 · see citing works
Internet of Things (IoT) security dataset evolution: Challenges and future directions
Kaur, B., Dadkhah, S., Shoeleh, F., Neto, E. C. P., Xiong, P., Iqbal, S., Lamontagne, P., Ray, S., & Ghorbani, A. A. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100780 · Cited by 188 · see citing works
A hybrid CNN-LSTM approach for intelligent cyber intrusion detection system
Bamber, S. S., Katkuri, A. V. R., Sharma, S., & Angurala, M. (2024) · Computers & Security · doi:10.1016/j.cose.2024.104146 · Cited by 168 · see citing works
Rock, L. Y., Tajudeen, F. P., & Chung, Y. W. (2022) · Universal Access in the Information Society · doi:10.1007/s10209-022-00937-0 · Cited by 153 · see citing works
IoT Network Traffic Classification Using Machine Learning Algorithms: An Experimental Analysis
Kumar, R., Swarnkar, M., Singal, G., & Kumar, N. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3121517 · Cited by 149 · see citing works
A novel deep learning-based intrusion detection system for IoT DDoS security
Hızal, S., Çavuşoğlu, Ü., & Akgün, D. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101336 · Cited by 114 · see citing works
App-Net: A Hybrid Neural Network for Encrypted Mobile Traffic Classification
Wang, X., Chen, S., & Su, J. (2020) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps50562.2020.9162891 · Cited by 110 · see citing works
Res-TranBiLSTM: An intelligent approach for intrusion detection in the Internet of Things
Wang, S., Xu, W., & Liu, Y. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109982 · Cited by 109 · see citing works
Self-attentive deep learning method for online traffic classification and its interpretability
Xie, G., Li, Q., & Jiang, Y. (2021) · Computer Networks · doi:10.1016/j.comnet.2021.108267 · Cited by 89 · see citing works
Graph based encrypted malicious traffic detection with hybrid analysis of multi-view features
Hong, Y., Li, Q., Yang, Y., & Shen, M. (2023) · Information Sciences · doi:10.1016/j.ins.2023.119229 · Cited by 65 · see citing works
Lightweight intrusion detection model based on CNN and knowledge distillation
Wang, L., Dai, Q., Du, T., & Chen, L.-F. (2024) · Applied Soft Computing · doi:10.1016/j.asoc.2024.112118 · Cited by 58 · see citing works
Deep transfer learning-based network traffic classification for scarce dataset in 5G IoT systems
Guan, J., Cai, J., Bai, H., & You, I. (2021) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-021-01415-4 · Cited by 55 · see citing works
Transformer-Based Device-Type Identification in Heterogeneous IoT Traffic
Luo, Y., Chen, X., Ge, N., Feng, W., & Lü, J. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2022.3221967 · Cited by 52 · see citing works
Encrypted TLS Traffic Classification on Cloud Platforms
Yun, X., Wang, Y., Zhang, Y., Zhao, C., & Zhao, Z. (2022) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2022.3191312 · Cited by 45 · see citing works
M2VT-IDS: A multi-task multi-view learning architecture for designing IoT intrusion detection system
Nie, F., Liu, W., Liu, G., & Gao, B. (2024) · Internet of Things · doi:10.1016/j.iot.2024.101102 · Cited by 45 · see citing works
Self-citationDhiman, G., & Alghamdi, N. S. (2024) · IEEE Transactions on Consumer Electronics · doi:10.1109/tce.2024.3363720 · Cited by 43 · see citing works
Hybrid VGG19 and 2D-CNN for intrusion detection in the FOG-cloud environment
Binbusayyis, A. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.121758 · Cited by 40 · see citing works
Spatial-temporal knowledge distillation for lightweight network traffic anomaly detection
Wang, X., Wang, Z., Wang, E., & Sun, Z. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103636 · Cited by 37 · see citing works
Efficient IoT Device Identification via Network Behavior Analysis Based on Time Series Dictionary
Zhao, J., Li, Q., Sun, J., Dong, M., Ota, K., & Shen, M. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3305585 · Cited by 36 · see citing works
Revolutionizing Encrypted Traffic Classification with MH-Net: A Multi-View Heterogeneous Graph Model
Zhang, H., Yue, H., Xiao, X., Yu, L., Li, Q., Ling, Z., & Zhang, Y. (2025) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v39i1.32091 · Cited by 34 · see citing works
Zhao, J., Li, Q., Hong, Y., & Shen, M. (2024) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2024.3350080 · Cited by 29 · see citing works
Three-layer hybrid intrusion detection model for smart home malicious attacks
Shi, L., Wu, L., & Guan, Z. (2021) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2021.107536 · Cited by 17 · see citing works
Empowering Anomaly Detection in IoT Traffic Through Multiview Subspace Learning
Nie, F., Liu, W., Liu, G., Gao, B., Huang, J., Tian, W., & Yuen, C. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3530771 · Cited by 14 · see citing works
Self-citationNie, F., Liu, G., Liu, W., Huang, J., & Gao, B. (2025) · Ad Hoc Networks · doi:10.1016/j.adhoc.2025.103916 · Cited by 9 · see citing works
Self-citationFA-Net: More Accurate Encrypted Network Traffic Classification Based on Burst with Self-Attention
Jiang, M., Cui, M., Hou, C., Cai, W., Li, Z., Xiong, G., & Gou, G. (2023) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn54540.2023.10191615 · Cited by 6 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Nageshwaran, V., & Ezekiel, S. (2026) · Electronics · doi:10.3390/electronics15122740 · Cited by 4 · see citing works
- Authors
- Nie, F., Liu, W., Liu, G., Gao, B., Huang, J., & Yuen, C.
- Affiliations
- Nanjing University of Science and Technology (CN)
- Nanjing University of Information Science and Technology (CN)
- Nanyang Technological University (SG)
- Venue
- IEEE Internet of Things Journal
- Published
- 2025-10-15
- Volume
- 12
- Issue
- 20
- Pages
- 42337-42351
- ISSN
- 2327-4662 (ISSN-L)
- 2372-2541
- OpenAlex
- W4412984935
- Cited by
- 1
- References
- 50
- Citations by year
- 2026: 1
- FWCI
- 0.42
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Internet of Things Journal (publishedVersion)
- DR-NTU (Nanyang Technological University) (submittedVersion)
- Funders
- National Key Research and Development Program of China (2021QY0700)
- National Natural Science Foundation of China (U21B2003, 62072250, 61602247)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Keywords
- lightweight student models, cross-attention fusion, resource-constrained IoT devices, IoT network security, network traffic classification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
