From Heavy Ensembles to Compact Edge Detectors: Minority-Aware Distillation for Intrusion Detection on Distributed Network Protocol 3 (DNP3) Traffic and Phasor Measurement Unit (PMU) Data in IoT-Enabled Smart Grids

Intrusion detectors for Internet of Things (IoT)-enabled substations must run on gateways with limited memory, yet the strongest published detectors are heavy tree ensembles. This study compresses a five-member soft-voting ensemble into compact multilayer perceptron (MLP) and gradient-boosted decision tree (GBDT) students on Distributed Network Protocol 3 (DNP3) flows (six attack families) and on phasor measurement unit (PMU) records of the MSU/ORNL dataset (attack versus natural events). Students were trained with class-weighted cross-entropy, weighting-only controls, and standard, minority-aware (MA-KD) and balanced distillation, and evaluated under stratified, chronological, and capture-held-out protocols. A class-weighted GBDT matched the teacher on both layers (macro-F1 0.986 versus 0.987 on DNP3; 0.908 versus 0.903 on PMU data) with 2.4% and 1.1% of its resident memory and 43.8 and 72.8 times lower single-thread CPU time per record, and stayed within 0.007 macro-F1 of the teacher under the stricter protocols. Distillation did not improve GBDT students. For MLP students, MA-KD was best on the stratified PMU split (0.734 versus 0.718 for standard distillation), whereas on DNP3 square-root class weighting without a teacher was best. Under the stricter protocols, PMU macro-F1 fell to about 0.60–0.63 for the teacher and all compact students (ExtraTrees: 0.53–0.55), identifying generalisation, not model size, as the main open problem.