QuCAD–IDS: cross–domain network intrusion detection via hierarchical contrastive autoencoding and queue-based adaptive distillation

Abstract The widespread deployment of IoT and heterogeneous networks poses significant challenges to traditional Network Intrusion Detection Systems (NIDS), especially in terms of cross-domain generalization and computational efficiency. To address these issues, we propose QuCAD-IDS, a lightweight cross-domain intrusion detection framework that integrates hierarchical contrastive autoencoding and queue-based adaptive distillation. First, a teacher model (HiMSR-CAE) is trained on a source domain using both reconstruction and attack-aware contrastive losses to learn transferable feature representations. Then, a queue-based contrastive distillation mechanism (QuCAD) transfers the structural knowledge of the teacher’s embedding space to a compact GhostNet student network. Finally, Maximum Mean Discrepancy (MMD) alignment and target-domain fine-tuning adapt the model to heterogeneous target domains. Extensive experiments on the UNSW-NB15, NSL-KDD, and CIC-IDS2017 datasets show that QuCAD-IDS achieves detection accuracy (e.g., 99.70% F1 on NSL-KDD multi-class) and cross-domain adaptability, while reducing model parameters by 98% and computational cost by two orders of magnitude. This work provides a practical, lightweight solution for deploying effective NIDS in edge and IoT environments.