Towards Privacy-Preserving and Continual Intrusion Detection Systems in Internet of Medical Things

Abstract

The rapid expansion of the Internet of Medical Things (IoMT) introduces critical vulnerabilities into healthcare infrastructures, demanding the development of enhanced cybersecurity strategies. This domain faces significant challenges arising from emerging and previously unknown attacks, combined with the decentralized nature of network traffic data, which is rarely shared due to stringent privacy constraints. To address these challenges, we propose a Federated Class Incremental Learning (FCIL) framework for Network Intrusion Detection System (NIDS) in the IoMT domain, enabling the continuous recognition of new attacks leveraging distributed data without exposing sensitive information. Findings on the CIC-IoMT24 dataset show that combining the incremental approach $\text{BiC}^{+}$ with the federated aggregation algorithm FedDyn achieves 71% F1 score in fine-grained misuse detection. While exhibiting a 14% F1 drop compared to the ideal centralized training-from-scratch, our approach ensures data privacy and computational efficiency.