A Two-Layer BiLSTM distillation-based method for network intrusion detection

A Two-Layer BiLSTM distillation-based method for network intrusion detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article A Two-Layer BiLSTM distillation-based method for network intrusion detection Jing Zhang, HongGang Miao, LuLu Wang, Xin Wang, Yang Yang, HaoQuan Luo This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7316391/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 13 You are reading this latest preprint version Abstract Traditional intrusion detection systems (IDS) based on rules and signatures face difficulties in processing complex temporal data and imbalanced datasets, such as loosely connected temporal context features, label mismatches, and the imbalance caused by a diverse range of data types, which significantly affect detection performance. To address these challenges, this paper proposes a dual-layer BiLSTM distillation-based network intrusion detection method (2DBM). This method integrates bidirectional LSTM (BiLSTM) layers with a dual distillation mechanism to capture temporal context features in both forward and backward directions, and enhances the model’s generalization ability when handling imbal-anced datasets through knowledge transfer between the teacher and student models. Key innovations include: (1) A dual distillation framework, transferring knowledge from the high-accuracy teacher model to the lightweight student model, reducing parameters by 38% (from 7.8M to 4.8M) and reducing inference latency by 60% (from 30ms to 12ms); (2) A temporal attention mechanism, 1 dynamically weighting key network traffic features using BiLSTM to improve robustness against imbalanced data; (3) A dual-layer BiLSTM architecture that captures bidirectional contextual dependencies while maintaining computational efficiency, further enhancing model accuracy and performance. Experiments conducted on the UNSW NB15 and CIC IDS2017 datasets show that the model achieves an accuracy of 99.86% on the UNSW NB15 dataset and 99.32% on the CIC IDS2017 dataset, with a false positive rate (FPR) below 0.5%. Compared to existing state-of-the-art models (Transformer-IDS and LightGRU), the proposed model demonstrates superior accuracy and real-time performance, effectively addressing the performance bottleneck of traditional IDS in handling imbalanced data and complex temporal contexts, while improving detection accuracy, real-time performance, and model lightweighting. Intrusion Detection System Knowledge Distillation Bidirectional Long Short-Term Memory Time Series Lightweight Real-time Detection Full Text Additional Declarations No competing interests reported. Supplementary Files Highlights.docx MiaoHongGang.zip Cite Share Download PDF Status: Under Review Version 1 posted Editorial decision: Revision requested 14 Feb, 2026 Reviews received at journal 22 Dec, 2025 Reviewers agreed at journal 22 Nov, 2025 Reviews received at journal 21 Nov, 2025 Reviewers agreed at journal 19 Nov, 2025 Reviewers agreed at journal 17 Nov, 2025 Reviewers agreed at journal 17 Oct, 2025 Reviews received at journal 16 Sep, 2025 Reviewers agreed at journal 26 Aug, 2025 Reviewers invited by journal 10 Aug, 2025 Editor assigned by journal 10 Aug, 2025 Submission checks completed at journal 09 Aug, 2025 First submitted to journal 07 Aug, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7316391","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":499522746,"identity":"3d51dc33-c639-451d-8071-d90e3e220e61","order_by":0,"name":"Jing Zhang","email":"","orcid":"","institution":"Kunming University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"Jing","middleName":"","lastName":"Zhang","suffix":""},{"id":499522750,"identity":"3ad80053-9bd8-455e-ae96-00cd0c228cfb","order_by":1,"name":"HongGang Miao","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA9UlEQVRIiWNgGAWjYHACNhiD/ceHCiDFzNxAtBYGyRlnQFoYSdAizdkGogho0W3vMXvwcUetXf/s9gvGjPNqo/nbgVp+VGzDqcXszBlzw5lnjifPuHOmILlw2/HcGYcZGxh7ztzGreVGjpk0b9uxZIYbOQmHZ247ltsA1MLM2EaEFvkbOYnNvHOO5c4nUkuNncGN9MPMvA01uRsIajlzrExyZtuBBMMbOWyMM44dyN0I1HIQr1+ON2+T+NhWZy93I/0Zw4eautx55w8ffPCjArcWKDic2MDAYwBigLkHCKkHgjp7YHp5AGIQoXgUjIJRMApGGgAAF9tje5/3v0QAAAAASUVORK5CYII=","orcid":"","institution":"Kunming University of Science and Technology","correspondingAuthor":true,"prefix":"","firstName":"HongGang","middleName":"","lastName":"Miao","suffix":""},{"id":499522751,"identity":"d6a4af6f-8405-42e5-befb-be674205a435","order_by":2,"name":"LuLu Wang","email":"","orcid":"","institution":"Kunming University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"LuLu","middleName":"","lastName":"Wang","suffix":""},{"id":499522752,"identity":"d4c0103c-4d50-4613-a74c-ccbf6990a0a3","order_by":3,"name":"Xin Wang","email":"","orcid":"","institution":"Kunming University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"Xin","middleName":"","lastName":"Wang","suffix":""},{"id":499522753,"identity":"2a6e3bc7-825f-4729-a841-072d70d1dbea","order_by":4,"name":"Yang Yang","email":"","orcid":"","institution":"Kunming University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"Yang","middleName":"","lastName":"Yang","suffix":""},{"id":499522754,"identity":"77b50a6b-a618-4533-a0a6-415dabab1831","order_by":5,"name":"HaoQuan Luo","email":"","orcid":"","institution":"Kunming University of Science and Technology","correspondingAuthor":false,"prefix":"","firstName":"HaoQuan","middleName":"","lastName":"Luo","suffix":""}],"badges":[],"createdAt":"2025-08-07 08:23:33","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7316391/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7316391/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":89108569,"identity":"2b7b21b2-bff9-4b40-8524-abdc8e046c8e","added_by":"auto","created_at":"2025-08-14 18:19:26","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":636707,"visible":true,"origin":"","legend":"","description":"","filename":"honggang2.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7316391/v1_covered_8b73e94d-59cc-4ace-8a40-2a1ab8d5b0ab.pdf"},{"id":89107903,"identity":"ab732ab2-f278-4fdc-b078-8f44eea95e77","added_by":"auto","created_at":"2025-08-14 18:03:24","extension":"docx","order_by":1,"title":"","display":"","copyAsset":false,"role":"supplement","size":11395,"visible":true,"origin":"","legend":"","description":"","filename":"Highlights.docx","url":"https://assets-eu.researchsquare.com/files/rs-7316391/v1/a47c4668146695bc245de5ba.docx"},{"id":89107908,"identity":"bf2d9ea5-7645-4a79-8622-07737305ca7e","added_by":"auto","created_at":"2025-08-14 18:03:25","extension":"zip","order_by":3,"title":"","display":"","copyAsset":false,"role":"supplement","size":477786,"visible":true,"origin":"","legend":"","description":"","filename":"MiaoHongGang.zip","url":"https://assets-eu.researchsquare.com/files/rs-7316391/v1/bbd1c5b255319d614fd6bee5.zip"}],"financialInterests":"No competing interests reported.","formattedTitle":"A Two-Layer BiLSTM distillation-based method for network intrusion detection","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"international-journal-of-machine-learning-and-cybernetics","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"jmlc","sideBox":"Learn more about [International Journal of Machine Learning and Cybernetics](http://actavetscand.biomedcentral.com/)","snPcode":"13042","submissionUrl":"https://submission.nature.com/new-submission/13042/3","title":"International Journal of Machine Learning and Cybernetics","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Intrusion Detection System, Knowledge Distillation, Bidirectional Long Short-Term Memory, Time Series, Lightweight, Real-time Detection","lastPublishedDoi":"10.21203/rs.3.rs-7316391/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7316391/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Traditional intrusion detection systems (IDS) based on rules and signatures face difficulties in processing complex temporal data and imbalanced datasets, such as loosely connected temporal context features, label mismatches, and the imbalance caused by a diverse range of data types, which significantly affect detection performance. To address these challenges, this paper proposes a dual-layer BiLSTM distillation-based network intrusion detection method (2DBM). This method integrates bidirectional LSTM (BiLSTM) layers with a dual distillation mechanism to capture temporal context features in both forward and backward directions, and enhances the model’s generalization ability when handling imbal-anced datasets through knowledge transfer between the teacher and student models. Key innovations include: (1) A dual distillation framework, transferring knowledge from the high-accuracy teacher model to the lightweight student model, reducing parameters by 38% (from 7.8M to 4.8M) and reducing inference latency by 60% (from 30ms to 12ms); (2) A temporal attention mechanism, 1 dynamically weighting key network traffic features using BiLSTM to improve robustness against imbalanced data; (3) A dual-layer BiLSTM architecture that captures bidirectional contextual dependencies while maintaining computational efficiency, further enhancing model accuracy and performance. Experiments conducted on the UNSW NB15 and CIC IDS2017 datasets show that the model achieves an accuracy of 99.86% on the UNSW NB15 dataset and 99.32% on the CIC IDS2017 dataset, with a false positive rate (FPR) below 0.5%. Compared to existing state-of-the-art models (Transformer-IDS and LightGRU), the proposed model demonstrates superior accuracy and real-time performance, effectively addressing the performance bottleneck of traditional IDS in handling imbalanced data and complex temporal contexts, while improving detection accuracy, real-time performance, and model lightweighting.","manuscriptTitle":"A Two-Layer BiLSTM distillation-based method for network intrusion detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-08-14 18:03:20","doi":"10.21203/rs.3.rs-7316391/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-02-15T01:50:31+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-12-22T17:50:57+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"98003653606873283053376618140164835742","date":"2025-11-22T21:41:12+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-11-21T17:30:08+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"294444317889167888451830182423995788707","date":"2025-11-19T14:50:39+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"287700910120540197896034769071260140040","date":"2025-11-17T18:35:01+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"320203217820865718088953446081102882552","date":"2025-10-17T06:23:36+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-09-16T15:14:00+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"322672069417652938434535980891914818109","date":"2025-08-26T17:58:10+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-08-10T13:23:21+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-08-10T12:58:34+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-08-09T09:18:06+00:00","index":"","fulltext":""},{"type":"submitted","content":"International Journal of Machine Learning and Cybernetics","date":"2025-08-07T08:21:32+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"international-journal-of-machine-learning-and-cybernetics","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"jmlc","sideBox":"Learn more about [International Journal of Machine Learning and Cybernetics](http://actavetscand.biomedcentral.com/)","snPcode":"13042","submissionUrl":"https://submission.nature.com/new-submission/13042/3","title":"International Journal of Machine Learning and Cybernetics","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"7d7455c7-8336-445d-8d81-c606f8253067","owner":[],"postedDate":"August 14th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-03-23T09:24:39+00:00","versionOfRecord":[],"versionCreatedAt":"2025-08-14 18:03:20","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7316391","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7316391","identity":"rs-7316391","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}