Hierarchical Federated Learning with Heavy-Hitter Detection for Real-Time Cyber Threat Mitigation in Large-Scale Networks

We propose a Hierarchical Federated Learning (HFL) framework integrated with Heavy-Hitter (HHH) detection to address the challenges of real-time cyber threat mitigation in large-scale networks. Conventional centralized intrusion detection systems suffer from scalability bottlenecks and privacy risks, while existing decentralized approaches often lack global consensus and produce high false-positive rates. The proposed method decomposes threat analysis into a three-tier architecture: edge-level HHH detectors identify localized anomalies in network traffic, mid-tier aggregators perform privacy-preserving model fusion, and a centralized transformer-based consensus engine validates alerts against historical threat intelligence. This hierarchical design reduces data volume by 80–90% at the edge, hence minimizing latency and bandwidth overhead. Moreover, the framework incorporates differential privacy during federated updates to protect sensitive network metadata. The system achieves 98.7% precision in zero-day attack classification by fine-tuning GPT-4-turbo for threat ontology alignment, while edge models inspired by Wav2Vec 2.0 enable efficient temporal traffic analysis. Unlike monolithic SIEM systems, our approach replaces rigid correlation rules with adaptive federated learning, dynamically balancing detection accuracy and operational cost. Experimental results on NetFlow v9 datasets demonstrate that the framework outperforms state-of-the-art NIDPS solutions in both detection speed and false-positive reduction. The integration with SOAR platforms further ensures automated, cost-optimized mitigation actions. This work bridges the gap between decentralized threat detection and global consensus, offering a scalable and privacy-aware alternative to traditional cybersecurity architectures.