Intrusion detection systems rely on prior knowledge, and their input data contain rich semantic information, making them well suited for large language models (LLMs). However, the computational overhead of LLMs and data privacy constraints make their direct deployment difficult. Meanwhile, although small models are convenient for deployment, their performance is limited. To address this issue, this study proposes an iterative model for intrusion detection based on data-driven distillation and performance motivation, termed as RADOM. RADOM performs knowledge distillation through data exchange between LLMs and small models, and improves the quality of LLM-generated data by using incorrect predictions from the small models as iterative feedback. At the same time, this study introduces a feature dimension optimization mechanism, in which LLMs are used to perform feature selection and iterative updating, thereby further improving the classification capability of small models. Experimental results on public datasets and self-collected datasets show that RADOM effectively improves the detection and classification performance of small models for attack behaviors, and the accuracy of small models increases from 67.30% to 96.19%, verifying the effectiveness of the proposed method.