A novel behavior-based intrusion detection framework, the Federated Intrusion Detection and Mitigation Framework (FIDMF), is proposed to address critical challenges in modern intrusion detection, including data privacy, scalability, severe class imbalance, and the critical need for semantic understanding and explainability. FIDMF integrates federated learning for privacy-preserving collaborative training with an Attention-Long Short-Term Memory (LSTM) core for robust temporal pattern detection. To substantially enhance the framework’s intelligence and transparency, FIDMF innovatively pioneers a multi-faceted integration of open-source Large Language Models (LLMs) for: 1) Contextual Feature Enrichment from raw network logs; 2) Semantic Data Augmentation, guided by LLMs to inform Generative Adversarial Networks (GANs) for generating semantically coherent and novel attack patterns; and 3) Explainable AI (XAI) for human-readable explanations. This holistic approach, further supported by the Synthetic Minority Over-sampling Technique (SMOTE) for class balancing, results in a robust, scalable, privacy-preserving, and highly explainable Intrusion Detection System (IDS). A rigorous evaluation across the NSL-KDD, CIC-IDS2017, and UNSW-NB15 datasets demonstrates FIDMF’s superior performance. On NSL-KDD, the full FIDMF framework achieved an outstanding overall accuracy of 99.40% and an F1-score of 99.38%. Critically, for the challenging minority attack class, it attained an F1-score of 99.70%, significantly outperforming prior configurations without LLM guidance. Furthermore, FIDMF maintained high accuracy on CIC-IDS2017 (99.65%) and UNSW-NB15 (98.05%), confirming its strong generalizability. An in-depth ablation study validates the crucial contribution of each component, particularly the semantic intelligence provided by the LLMs. FIDMF proves its potential as a superior, intelligent, and transparent solution for real-world intrusion detection scenarios.

The rapid proliferation of Internet of Things (IoT) devices presents significant security challenges due to inherent vulnerabilities and increasing cyberattacks. Effective intrusion detection systems (IDSs) are crucial for securing IoT environments, requiring high detection accuracy while efficiently handling large data volumes and critically minimizing both false negatives (FNR), which miss real attacks, and false positives (FPR), which cause unnecessary alarms. Traditional methods and standalone deep learning models often struggle to achieve an optimal balance between these requirements. This paper proposes a novel hybrid IDS framework designed to enhance IoT network security by integrating time series analysis with deep learning. Specifically, we leverage seasonal-trend decomposition using Loess (STL) as an intelligent pre-filtering mechanism to isolate potentially anomalous traffic, which is then classified using sophisticated deep learning models, with a particular focus on long short-term memory (LSTM) networks compared against recurrent neural networks (RNN) and dense neural networks (DNN). The proposed framework performance was rigorously evaluated using the comprehensive and realistic BoT-IoT dataset. The methodology involved principal component analysis (PCA) for dimensionality reduction and careful hyperparameter tuning. The experimental results demonstrate the effectiveness of the hybrid approach, with the STL-LSTM variant achieving superior performance. It attained an overall accuracy of 98.5% and a macro F1-score of 98.49%, while significantly reducing the overall false negative rate to 5.2% (FNR ≈ 0.24) and the overall false positive rate to 0.276% (FPR ≈ 0.11) across five Attack/Normal classes. These results represent a substantial improvement over standalone deep learning models (standalone LSTM FNR = 0.302, FPR = 0.185) and compare favorably to state-of-the-art benchmarks reported in the literature, particularly in minimizing critical detection errors. The findings indicate that the proposed hybrid STL-LSTM framework presents a robust and viable solution for high-stakes IoT network security, effectively balancing high detection accuracy with exceptionally low error rates, making it well-suited for real-time deployment in protecting critical IoT infrastructure.