Abstract: In dynamic heterogeneous networks, massive heterogeneous terminals result in dispersed and diverse security data. While federated learning enables collaborative intrusion detection across terminals without compromising data privacy, its open architecture is inherently vulnerable to Byzantine attacks, where malicious clients poison the global model by uploading crafted gradients. Existing Byzantine-robust methods are typically effective only against specific attack types and struggle to cope with the coexistence of multiple attacks in real-world environments. Moreover, they suffer from high false-negative rates under sparse real-traffic conditions, and the computational overhead of stacking multiple defenses is prohibitive for resource-constrained terminals. To address these challenges, we propose GF-FedIDS, a Byzantine-robust federated learning intrusion detection framework based on gradient fingerprint decision-making. By analyzing the gradient statistics of typical Byzantine attacks, we establish a deterministic mapping from attack patterns to optimal defenses and reveal their causal relationship. A gradient fingerprint decision tree is designed to adaptively select a single optimal defense strategy, achieving full-coverage robust aggregation at unit computational cost. Furthermore, a class-aware instance weighting mechanism is introduced to mitigate missed detections under data imbalance. Extensive experiments on three public datasets and eight attack types demonstrate that, in single-attack scenarios, the attack detection rate (ADR) of GF-FedIDS outperforms that of the best baseline across three datasets; in mixed-attack scenarios, ADR reaches 1.45–2.14 times; and under extreme imbalance with a 5% attack rate, ADR is 2.06–2.29 times that of the best baseline. Additionally, GF-FedIDS incurs only a 16% computational overhead compared with FedAvg, outperforming existing ensemble defense methods.