<p>The widespread deployment of various types of IoT (Internet of Things) devices has created severe security threats, especially in real-time applications, rendering traditional intrusion detection systems (IDSs) unsuitable for large-scale real-time data, privacy preservation, and diverse cyber threats. The state-of-the-art centralised solutions have a strong appetite for labelled data that must be collected at a central server, which introduces latency, a larger attack surface, and regulatory compliance challenges when applied in distributed settings. Additionally, existing work does not leverage the joint effect of federated learning, edge computing, and big data analytics to achieve scalable, privacy-preserving cyberattack detection. To overcome these challenges, this paper presents CyberFedEdgeAI, a big data-based and scalable framework for real-time cyber-attack detection in heterogeneous IoT applications. At the heart of the proposed deep learning model, FedSecureNet, we combine convolutional layers, bidirectional LSTM units, and attention mechanisms to extract spatial and temporal features from streaming IoT data. Trained amongst multiple Docker-simulated edge clients with federated learning to preserve data locality and privacy. Apache Kafka and Spark are used to implement real-time data ingestion, processing, and storage on HDFS, a distributed storage system that scales analytic workloads. Experimental results on two benchmark data sets—TON_IoT and N-BaIoT—show that the proposed framework outperforms the compared methods, achieving 94.2% and 92.4% accuracy, respectively. Specifically, FedSecureNet achieves superior performance compared to the centralised CNN, LSTM, and Transformer-based baselines, with low latency and efficient resource use. They validate the effectiveness of the framework’s approach in improving detection accuracy, protecting data privacy, and its suitability for a large-scale, real-time IoT system environment.</p>