HAF-BiTrans: A Heterogeneity-Aware Federated BiLSTM-Transformer Framework for Privacy-Preserving Detection of Multi-Stage APT Behaviors in IoT Networks

Advanced persistent threats (APTs) are difficult to detect in heterogeneous Internet of Things (IoT) environments because malicious behavior can unfold across reconnaissance, scanning, command-and-control, denial-of-service, and exfiltration stages. Centralized intrusion-detection pipelines also create privacy, communication, and latency concerns when traffic originates at distributed edge devices. This study presents HAF-BiTrans, a heterogeneity-aware federated BiLSTM-Transformer framework for privacy-preserving detection of multi-stage APT-like behavior. At each client, a bidirectional long short-term memory encoder captures temporal dependencies, a lightweight Transformer models broader contextual relationships, and a class-balanced focal objective addresses class imbalance. At the server, Heterogeneity-Aware Contribution-Trust Aggregation (HACTA) weights client updates using sample support, class-coverage entropy, validation macro-F1, update stability, and differential-privacy reliability. Experiments on CICIoT2023, TON_IoT, and BoT-IoT show marked variation across datasets. HAF-BiTrans + HACTA achieved 89.29% accuracy and 88.93% macro-F1 on TON_IoT and 84.91% accuracy and 84.77% macro-F1 on BoT-IoT. On the more imbalanced CICIoT2023 experiment, centralized HAF-BiTrans reached 25.42% accuracy and 16.88% macro-F1, whereas the federated HACTA configuration reached 20.34% accuracy and 9.59% macro-F1. Thus, the present CICIoT2023 implementation does not outperform a strong tabular baseline and should not be interpreted as a state-of-the-art result. Its practical strength is efficiency: the model occupies approximately 0.052 MB and performs inference in under 0.1 ms per window. These findings position HAF-BiTrans as a compact, edge-oriented federated architecture whose robustness under difficult non-IID conditions still requires further optimization.