An Accurate And Lightweight Intrusion Detection Model Deployed on Edge Network Devices

Edge network devices are typically resource-constrained, but intrusion detection requires real-time capabilities. Currently deep learning detection models for raw traffic data require significant computational resources, which does not meet our requirements. In addition, purely manual feature extraction may lead to lower accuracy, even though it can make the algorithm more lightweight. Taking these considerations into account, this paper proposes a machine learning network—LLAMNet, which offers lower latency and memory requirements. The proposed model takes a more comprehensive approach to capturing the deep structure of network traffic. It leverages attention mechanisms to effectively uncover the temporal characteristics among the packets that form the network flow. This enables a more thorough exploration of the sequential features within the data. To minimize latency and memory overhead, sparse self-attention mechanisms and self-attention distillation techniques are utilized in our approach. Additionally, in order to better suit the intrusion detection task, we have implemented enhancements that enable the lightweight network architecture to achieve accurate detection rates. Furthermore, experiments were conducted on publicly available datasets, including a series of ablation experiments to assess the effectiveness of our improvements.