Exploring a Hybrid BiLSTM-Transformer Model for Detecting Intrusions in Federated Learning Settings

The rapid growth of 5G and Internet of Things (IoT) networks has made cyberattacks more advanced, demanding next-generation Intrusion Detection Systems (IDS) that balance privacy, scalability, and resilience. Traditional IDS models struggle in Federated Learning (FL) environments, facing challenges like data heterogeneity, adversarial threats, and auditability issues. To overcome these limitations, we propose a blockchain-powered FL framework with a hybrid FT-BiLSTM model for intrusion detection. This approach leverages Bidirectional Long Short Term Memory (BiLSTM) to capture evolving attack patterns and Feature Tokenizer (FT) Transformer to extract meaningful insights from complex tabular data. A permissioned blockchain secures model updates, ensuring tamper-proof learning and preventing Byzantine attacks. Meanwhile, advanced preprocessing techniques enhance adaptability to diverse network traffic. Tested on the UNSW-NB15 dataset [1], [2], [3], [4], [5], our model demonstrates superior accuracy and efficiency, outperforming traditional IDS approaches. By combining FL, blockchain, and hybrid deep learning, this framework delivers highly secure, decentralized threat detection, setting a new bench-mark for scalable, privacy-preserving cybersecurity solutions in modern networks.