Jul 2026· Frontiers in Big Data· Vol 9· 0 citations· 46 references
Medicine
TL;DR
The proposed Self-Healing IoT-Optimized Random Forest framework provides stable and safety-oriented intrusion detection capability under heterogeneous IoMT deployment conditions while maintaining strict testing independence and robust performance under rigorous evaluation settings.
Abstract
Introduction ARP spoofing poses a major security threat to Internet of Medical Things (IoMT) networks by enabling man-in-the-middle attacks that compromise the integrity of life-critical communications. Existing intrusion detection methods fail to simultaneously address temporal attack dynamics, unequal medical safety requirements, and explicit control of false negative rates. Methods This study proposes the Self-Healing IoT-Optimized Random Forest (SH-IORF) framework, which integrates temporal behavioral feature engineering, validation-guided cost-sensitive learning, and medical safety-constrained threshold optimization. To ensure methodological rigor and prevent information leakage, a stratified three-way partitioning strategy consisting of training, validation, and completely held-out testing datasets was employed. Class penalty weights and operating thresholds were determined exclusively from the validation dataset. Results Experimental evaluation on the CICIoMT2024 benchmark demonstrated that the proposed SH-IORF framework achieved 99.90% accuracy, 99.83% recall, 99.95% precision, a 0.9989 F1-score, and an AUC-ROC of 0.9996. The framework limited the false negative rate to 0.17%, satisfying the predefined medical safety constraint (FNR ≤ 0.5%), corresponding to 40 missed detections among 23,390 attack samples and 12 false alarms across 28,768 benign traffic instances. Discussion The results demonstrate that the proposed framework provides stable and safety-oriented intrusion detection capability under heterogeneous IoMT deployment conditions while maintaining strict testing independence and robust performance under rigorous evaluation settings.
Distributed Denial-of-Service (DDoS) attacks remain one of the most disruptive threats to network infrastructure, yet many machine learning (ML)-based detection studies report only offline benchmark performance without verifying whether that performance holds under real network conditions. This study evaluates two explainable ML classifiers, XGBoost and Random Forest, for DDoS detection and examines whether their near-perfect offline accuracy translates into reliable physical-network operation. The study combines offline benchmarking on the CIC-DDoS2019 dataset (293,485 flows) with physical-network validation using a working Intrusion Detection System (IDS) prototype under a controlled SYN-flood attack. Session-disjoint stratified sampling prevented flow-level leakage across attack sessions, while SHapley Additive exPlanations (SHAP) interpreted global and local feature importance. Offline, both classifiers achieved near-perfect performance (accuracy 99.99% for XGBoost, 99.98% for Random Forest; F1 = 0.9999; ROC-AUC up to 1.0000), with no statistically significant difference between them (McNemar's exact test, p = 0.2188), though XGBoost achieved approximately 3.69 times higher inference throughput (1,819,816 flows/s). SHAP identified Min Packet Length, Fwd Packet Length Min, Inbound, Protocol, and Init_Win_bytes_forward as the most influential features. In physical deployment, however, the IDS prototype flagged 6.26% of captured flows (6,935 of 110,762) as ATTACK during the SYN-flood test, and a separate 397-flow ambient-benign subset yielded a 6.80% false positive rate (95% Wilson CI: 4.72–9.71%), with short-duration SSDP/UPnP-style UDP control traffic accounting for 70% of observed false positives. This gap shows that near-perfect offline accuracy does not guarantee low false positives in real deployment, indicating that offline benchmarks alone are insufficient for validating IDS readiness.
Muhammad Azzam Anshori, R. Amri· Journal of Computer Science...· 0 citations
Healthcare IoMT networks face a security problem that the published literature has not fully solved. Connected cardiac monitors, infusion pumps, and wearable sensors run lightweight protocols designed for efficiency, not for resisting attack. When those devices are compromised, the consequence is not merely a data breach. It is a patient safety event. Yet most published intrusion detection systems for this environment train on a single dataset from 2015 and have never seen ransomware, Mirai botnet traffic, or injection attacks. This gap is not trivial. An IDS that has never seen a threat category cannot detect it in deployment. We address this by combining three publicly available datasets UNSW-NB15, TON_IoT, and CICIoT2023 into a single training corpus of 5,751,048 network flow records covering 17 unified attack categories. On that data, we train a two-stage hybrid pipeline. A 200-tree Random Forest screens every flow in under one millisecond as normal or malicious. Flows flagged as malicious go to a five-layer Feed-Forward Neural Network that identifies which of sixteen specific attack categories the flow belongs to. Tested on 1,150,210 held-out flows, Stage 1 reached 99.55 percent binary accuracy and ROC-AUC of 0.9997. Stage 2 reached 99.45 percent weighted accuracy with F1-score of 0.9953. Privacy is the second problem we address. A shared IDS trained across hospitals requires pooling patient network data, which HIPAA and GDPR prohibit. We implemented federated learning with Gaussian differential privacy noise across five simulated IoMT nodes. No raw traffic record left any node during fifteen training rounds. The global federated model reached 96.46 percent accuracy in convergent rounds, a privacy cost of just 2.99 percentage points. We also report a novel negative finding: Batch Normalisation is incompatible with FedAvg weight averaging under DP noise because the averaged population statistics become incoherent, collapsing global accuracy to majority-class prediction in some rounds. The fix replacing BatchNorm with LayerNorm is identified and documented. Against seven published baselines, our system improves binary accuracy by 5.55 percentage points and multi-class accuracy by 14.05 percentage points. End-to-end inference takes under two milliseconds per flow on standard CPU hardware.
Mahendra Singh Panwar, Jai Singh Gupta, Akash Saxena et al.· International journal on eme...· 0 citations
This work proposes an intelligent, lightweight Tiny LSTM–GRU hybrid IDS on the edge to monitor device-generated behavioral patterns in real time, with minimal computational and energy overhead, and proposes an adaptive FedProx-based weighted federated learning framework.
Emmanuel Udok, B. Stephen, U. Luke et al.· E3S Web of Conferences· 0 citations
The Internet of Medical Things (IoMT) is transforming healthcare through continuous patient monitoring, telemedicine, cloud–edge services, and Healthcare 5.0. However, the rapid growth of interconnected medical devices has expanded the healthcare cyberattack surface, making intelligent intrusion detection essential for protecting sensitive medical data and ensuring resilient clinical operations. Existing reviews examine specific aspects of AI-powered intrusion detection but rarely provide a deployment-oriented synthesis linking technical performance with operational and clinical requirements. This review critically examines Artificial Intelligence (AI)-powered Intrusion Detection Systems (IDSs) for IoMT across six analytical dimensions: detection performance, explainability, privacy preservation, computational efficiency, benchmarking practices, and cross-dataset generalization. This structured narrative review adopted the PRISMA 2020 framework to ensure transparent record identification, screening, and reporting, with evidence synthesized qualitatively rather than through quantitative meta-analysis. A total of 5127 records published between 2021 and 2026 were screened, resulting in 24 primary studies supported by 115 complementary studies. The findings show that machine learning, deep learning, hybrid AI, Explainable Artificial Intelligence (XAI), Federated Learning (FL), blockchain-assisted security, and edge intelligence have significantly advanced IoMT intrusion detection. However, despite benchmark accuracies often exceeding 95%, deployment remains constrained by dataset dependency, weak cross-dataset generalization, computational overhead, limited explainability, fragmented benchmarking, and insufficient operational validation. This review identifies deployment readiness, rather than predictive accuracy alone, as the principal challenge for next-generation healthcare cybersecurity and provides a practical framework for developing trustworthy, interoperable, privacy-preserving, and deployment-ready IoMT cybersecurity architectures supported by standardized evaluation protocols.
Jahidul Islam, Dristi Datta, Fowzia Akhter· Italian National Conference...· 0 citations
As interconnected devices increasingly transmit personal and sensitive data, security attacks are becoming more sophisticated and prevalent, highlighting the critical need for effective security solutions in Internet of Things (IoT) environments. An automated Network Intrusion Detection (NID) system plays a vital role in notifying system administrators of security breaches, acting as an efficient tool for protecting IoT networks from various threats. This study utilizes the UNSW-NB 15 dataset to enhance intrusion detection accuracy by addressing performance challenges and class imbalances within the data. We employ a combination of feature selection techniques, including Filter Method, Wrapper Method, and an Embedded approach using Lasso and Random Forest with Recursive Feature Elimination (RFE), alongside Pearson Correlation Coefficient (PCC). To tackle class imbalance, we apply the Synthetic Minority Over-sampling Technique (SOMTE). Various algorithms are implemented, including Random Forest, Decision Tree, AdaBoost, Bernoulli Naive Bayes, K-Nearest Neighbors, and Logistic Regression. Notably, the Stacking Classifier, which combines Boosted Decision Trees, Bagging with Random Forest, and LightGBM, demonstrates high performance in accurately detecting intrusions, significantly improving detection rates and reducing false alarms.
Rangu Shashidhar, M. Raju· International Journal of Eng...· 1 citation
This study proposes a hybrid machine learning-based intrusion detection and prevention framework for securing IoT networks that integrates Isolation Forest, Autoencoder, Extreme Gradient Boosting, and Bidirectional Long Short-Term Memory models within a stacked ensemble architecture to improve attack detection while reducing false-positive predictions.
Ruthwik Palem, Likhith Reddy Peketi, Vanathi M et al.· Cureus Journal of Computer S...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
