Machine learning-based intrusion detection requires complex models to capture patterns in high-dimensional, noisy, and class-imbalanced raw network traffic, yet deploying such models remains impractical on resource-constrained devices with limited processing power and memory. In this paper, we present a correlation-aware divide-and-conquer learning technique that decomposes a complex learning problem into smaller, more manageable subproblems. This enables lightweight models as simple as decision trees to be trained on focused subtasks, yielding up to 43.3% higher local accuracy and up to 257 times reduction in model size on real-world network intrusion detection datasets, while also improving adversarial robustness and explainability.
@article{arxiv.2605.02015,
title = {Robust and Explainable Divide-and-Conquer Learning for Intrusion Detection},
author = {Yan Zhou and Kevin Hamlen and Michael De Lucia and Murat Kantarcioglu and Latifur Khan and Sharad Mehrotra and Ananthram Swami and Bhavani Thuraisingham},
journal= {arXiv preprint arXiv:2605.02015},
year = {2026}
}