摘要： 随着物联网的广泛应用，海量设备接入网络，其安全漏洞易被攻击者利用，严重威胁网络与数据安全。因此，在物联网环境中部署入侵检测系统，对异常流量与入侵行为进行检测与防护显得尤为重要。然而，物联网设备通常计算能力有限、存储资源不足，导致现有的基于深度学习的入侵检测模型难以直接部署。针对以上问题，文章提出一种定制的轻量级入侵检测模型FDRBT，旨在资源受限条件下实现对物联网攻击行为的准确检测。文章利用皮尔逊相关系数(PCC)以及主成分分析(PCA)两种方式进行融合特征降维，并通过渐进式模块替换方法逐渐将基于Transformer结构的教师模型换成更简洁的Poolformer结构。为了弥补知识蒸馏过程中的表征能力损失，文章还引入了动态tanh（DyT）激活功能对模型进行增强，用DyT层取代Poolformer中传统的归一化层。这种设计使模型能够根据输入特征分布自动调整激活特性，在无需计算激活统计量的前提下实现类似归一化层的功能。在TON-IoT和CIC-BCCC-NRC-2024数据集上的实验结果显示，FDRBT模型在保持较小体积与较低计算开销的同时，分别取得了99.91%和99.96%的准确率，适用于资源受限的物联网入侵检测场景。

Abstract: With the wide application of the Internet of Things, a large number of devices access to the network, and its security vulnerabilities are easy to be exploited by attackers, which seriously threatens network and data security. Therefore, it is particularly important to deploy intrusion detection systems in the Internet of things environment to detect and protect abnormal traffic and intrusion behavior. However, IoT devices usually have limited computing power and insufficient storage resources, which makes the existing intrusion detection models based on deep learning difficult to be directly deployed. To solve the above problems, this paper proposes a customized lightweight intrusion detection model named FDRBT, which aims to achieve accurate detection of IoT attacks under resource-constrained conditions. In this paper, Pearson Correlation Coefficient (PCC) and Principal Component Analysis (PCA) are used to fuse feature dimension reduction, and the teacher model based on Transformer structure is gradually replaced by a more concise Poolformer structure by a progressive module replacement method. In order to compensate for the loss of representation ability in the process of knowledge distillation, the Dynamic tanh (DyT) activation function is also introduced to enhance the model, and the traditional normalization layer in Poolformer is replaced by DyT layer. This design enables the model to automatically adjust the activation properties according to the input feature distribution, achieving a normalization layer-like function without calculating the activation statistics. Experimental results on TON-IoT and CIC-BCCC-NRC-2024 datasets show that the FDRBT model achieves 99.91% and 99.96% accuracy respectively. The model also maintains a small size and low computational overhead, which is suitable for resource-constrained IoT intrusion detection scenarios.