BXLL: A Bi-LSTM stacking ensemble with SDN-Driven honeypot engagement for adaptive IoT intrusion detection

The proliferation of Internet of Things (IoT) devices has expanded the cyberattack surface, exposing resource-constrained endpoints to Distributed Denial-of-Service (DDoS) attacks, Advanced Persistent Threats (APTs), and zero-day exploits that signature-based Intrusion Detection Systems (IDS) cannot reliably counter. A critical gap separates detection from active attacker engagement: honeypots operate in static isolation with no feedback into detection pipelines, while IDS solutions cannot autonomously redirect adversaries or harvest intelligence. This paper proposes the Collaborative Cyber Deception (CCD) framework, a four-stage closed-loop architecture integrating real-time detection, Software-Defined Networking (SDN)-enforced redirection, multi-protocol honeypot engagement, and continuous retraining. The BXLL detection stage is empirically validated on benchmark data; the redirection, honeypot, and retraining stages are executed in a discrete-event simulation of the full pipeline under Poisson load, though not on hardware. At the core of CCD is the BXLL stacking ensemble, in which Bidirectional Long Short-Term Memory (Bi-LSTM) binary predictions are concatenated with standardised flow features as temporal meta-features before training LightGBM and XGBoost base learners, whose outputs are unified by a Logistic Regression meta-learner. Class imbalance is addressed through inverse-frequency weighting. On full hold-out test sets, BXLL achieves accuracy of 99.23%, 99.83%, and 99.34% with F1-Scores of 97.01%, 99.83%, and 99.41% on UNSW-NB15, X-IIoTID, and CIC-ToN-IoT. P95 per-sample inference latency is ≤ 266 μ s. The estimated component-level detection-to-redirection budget is 1.6 ms, but the simulation shows that batch-formation delay of 5.3–14.4 ms dominates it at the gateway, and that the SDN controller must be provisioned against the redirect rate implied by a deployment’s attack rate. McNemar’s test confirms significant superiority over the Decision Tree baseline ( p < 0.001) on all three datasets. XGBoost alone is nonetheless competitive with the full ensemble on every metric reported here, so the contribution is claimed for the closed-loop architecture rather than for the stacking design.