A Multi-Head Feature-Expert Detection framework for intrusion detection in the Internet of Medical Things

Abstract

Internet of Medical Things (IoMT) networks face cyberattacks that can disrupt patient care, yet most intrusion detection approaches treat all flows as structurally equivalent, cannot flag previously unseen traffic, and offer no route to a new clinical environment. Supplying those two capabilities normally means adding models a gateway cannot host, so this study derives both from a decomposition of the detector itself and measures the cost. MHFED routes each flow by three elementary statistics to one of three specialised classifiers. Every expert scores every flow, so output divergence yields a novelty signal; routing partitions the data, so experts refit independently as the environment drifts. On two public IoMT datasets the decomposition proves accuracy-neutral: MHFED reaches 98.55% macro-F1 on RT-IoT2022, separable from neither the strongest baselines nor an ensemble of equal capacity. Partitioning also makes an otherwise prohibitive model family affordable to refit in place. The disagreement signal is the only novelty score needing no extra model that ranks unseen attacks above training traffic; established confidence- and entropy-based scores are rank-inverted, hence misleading. No method transfers without target supervision, though labelling 5% of the target domain restores near-source accuracy. The results quantify what edge-deployable novelty detection and cross-environment adaptation cost.