A Lightweight Cross-Domain Adaptation Method for Network Intrusion Detection via Time-Series GAN

This study aims to address the challenges of high computational overhead in resource-constrained environments and performance degradation across heterogeneous networks inherent to network Intrusion Detection Systems (IDS). To this end, we propose and implement a comprehensive detection framework spanning from lightweight design to cross-domain adaptation. First, to meet real-time processing requirements, we employ a Knowledge Distillation strategy; utilizing a high-performance teacher network to guide a two-layer BiLSTM student model—comprising a mere 4.8 million parameters—we achieved a 92.4% reduction in inference latency while maintaining high accuracy, bringing the average latency per sample down to a mere 1.42 ms. Second, to overcome the issue of data distribution shift in cross-domain scenarios, we innovatively introduce TS-GAN: a cross-domain adaptation network endowed with temporal awareness. Through an adversarial game between a generator and a discriminator, TS-GAN enforces the alignment of feature distributions between the source and target domains within a manifold space. Our findings reveal a significant co-evolutionary trend between generation quality (measured by FID) and detection performance (measured by F1-score); ultimately, in a transfer task from the UNSW-NB15 dataset to CIC-IDS2017, the model achieved an F1-score of 90.13%, thereby validating its adaptive capability in environments involving unknown protocols. Finally, through ablation studies and robustness stress tests, we demonstrate that our proposed solution exhibits exceptional defensive resilience even under 15% feature perturbation, significantly reducing both false negative and false positive rates. This work provides a solid theoretical foundation and empirical evidence for the construction of intelligent security defense systems characterized by low power consumption and high transferability.