2026· International Journal of Advanced Computer Science and Applications· Vol 17· 0 citations· 21 references
TL;DR
Results demonstrate the efficacy of strategic dimensionality reduction in securing critical healthcare infrastructures and integrating the SHAP algorithm ensures decision-making transparency, addressing the “black box" challenge in medical AI.
Abstract
With the widespread adoption of the Internet of Medical Things (IoMT), hospitals have become prime targets for cyberattacks. To overcome the limitations of traditional defenses and computationally heavy deep learning models, a hybrid Artificial Intelligence architecture is presented. By coupling a deep Autoencoder for feature extraction with a Random Forest classifier, the input space is reduced from 44 down to 16 latent dimensions. While a standalone Random Forest achieves 98.95%accuracy, it remains too resource-intensive for constrained edge devices. The proposed hybrid approach strategically accepts a marginal sacrifice in accuracy—achieving 94.60% overall—in exchange for a drastic reduction in computational complexity. Rigorously validated on the CICIoMT2024 dataset and balanced via SMOTE-ENN, this model achieves an ultra-low inference latency of 1.05 ms on edge-grade hardware, making it highly viable for Edge Computing deployment. Furthermore, integrating the SHAP algorithm ensures decision-making transparency, addressing the “black box" challenge in medical AI. These results demonstrate the efficacy of strategic dimensionality reduction in securing critical healthcare infrastructures.
A hybrid detection framework is proposed that integrates a Random Forest classifier with an unsupervised anomaly detection model based on a deep autoencoder combined through a Logistic Regression metaclassifier that addresses the gap in single-model detectors that either rely on fixed decision boundaries that struggle with gradually evolving stealthy FDIA patterns or on anomaly detection that lacks strong discriminative power in separating subtle adversarial deviations from normal operational variability.
A. Albarrak, Fuad A. Ghaleb, Sultan Noman Qasem et al.· Italian National Conference...· 0 citations
With the rapid expansion of the Internet of Medical Things (IoMT), the risks of cybersecurity have increased exponentially in healthcare settings, exposing patients’ safety. Three fundamental issues that existing intrusion detection systems (IDS) are challenged by are: (1) limited cross-domain generalization, (2) high computation requirements not suitable for edge deployment, and (3) absence of systematic comparison between classical machine learning (ML) and deep learning (DL) approaches on IoMT-specific data. In this paper, we propose a multi-dataset evaluation framework that covers six models (Random Forest, XGBoost, DNN, CNN, LSTM, and CNN-LSTM) across three different datasets: WUSTL-EHMS-2020, Edge-IIoTset, and UNSW-NB15. We show that there is a scale-dependent pattern: classical ensemble methods work best when the data is small (F1 = 0.914 ± 0.013 on WUSTL-EHMS-2020); the proposed hybrid CNN–Ensemble framework performs best when the data is large (F1 = 0.968 ± 0.002 on UNSW-NB15 with 62.8% fewer features). The proposed framework achieves a total model size of 2.11 MB and an inference latency of 111.6 ms, with seven out of the top 15 discriminative features being patient vital signs, giving the first quantitative evidence that physiological data systematically contributes to IoMT attack detection, which is demonstrated through an explainability analysis using the SHAP approach. Cross-dataset generalization experiments across six transfer scenarios expose fundamental limitations in domain transfer, establishing an important baseline for future research.
Faris A. Kateb, O. Khan, F. Khan· Computers· 0 citations
Internet of Medical Things (IoMT) networks are hard to protect: devices are heterogeneous, computing resources are scarce, and traffic must be analyzed in real time. We present an intrusion detection system that addresses these constraints through feature selection. A Pearson correlation filter first removes redundant attributes; a hybrid strategy then combines model-based feature importance with SHAP attribution to pick a compact subset, on which we train Random Forest and LightGBM classifiers. SHAP and LIME explain what each retained feature contributes to the decisions. On CIC-IoMT 2024 and CIC-IDS 2017, the method cuts the feature space by up to 88% - from 40 to as few as 5 features - and accuracy and F1-score stay within a few points of models trained on all features. Compact, interpretable detectors of this kind are practical candidates for deployment on resource-limited medical networks.
Amira Berrezzek, H. Djellali, Giulio Mallardi et al.· 0 citations
Network intrusion detection remains a fundamental cybersecurity challenge due to the increasing diversity and sophistication of malicious network traffic. Conventional signature-based approaches exhibit limited capability in detecting previously unseen attacks, while many machine learning methods suffer from class imbalance, high false-positive rates, and limited adaptability across heterogeneous network environments. To address these challenges, this paper proposes HADS-Net (Hybrid Attention-based Deep Security Network), which integrates a feature-wise multi-head self-attention module with a stacked ensemble consisting of Random Forest and Gradient Boosting base learners combined through out-of-fold stacking and a logistic regression meta-learner. The attention mechanism adaptively emphasizes informative network features to improve discriminative learning, while the stacking strategy enhances generalization and reduces overfitting. Experiments were conducted on a class-stratified 15,000-record subsample derived from the NSL-KDD KDDTrain+ corpus, in which the minority R2L and U2R categories were deliberately enriched to obtain usable test support; the subsample was divided into 70% training and 30% testing partitions, giving a held-out test partition of 4,500 records. Because this constructed distribution departs from the native NSL-KDD proportions, the results reported here are not directly comparable with published KDDTest+ figures, and no such comparison is claimed. The proposed model achieved 96.20% accuracy, 97.57% precision, 94.32% recall, 95.92% F1-score, and 98.83% AUC-ROC on the binary Normal-versus-Attack task. A multi-layer perceptron baseline attained higher accuracy (98.11%) and F1-score (97.99%) than the proposed model on the same partition, and the ablation deltas attributable to the attention and stacking components lie below 0.5%; these deltas are reported as single-run point estimates. The principal contribution of this work is consequently architectural and diagnostic rather than a performance improvement: it documents that combining feature-wise attention with out-of-fold stacked generalization does not, in this setting, outperform a plain multi-layer perceptron, while incurring the highest memory footprint of the six models evaluated.
M.Rajesh Khanna, V. S. N. Murthy, Siva Ramavarapu et al.· International Journal for Gl...· 0 citations
The growth of Internet of Things devices has expanded the number of attackable targets of advanced cyber threats by orders of magnitude, and the limited computational capabilities of IoT devices have made more traditional intrusion detection systems infeasible to execute at the edge. A Knowledge-Distilled Multi-Model Intrusion Detection and Prevention System is presented, which combines a Residual Graph Convolutional Network, Long Short-Term Memory classifier, and a Conditional Tabular Generative Adversarial Network enhanced with the student-only autoencoders through multi-loss knowledge distillation to create a high-performing Teacher ensemble and compresses its intelligence into an edge-deployed system. The system is evaluated using the IoT-23 benchmark of 325 million network flow records and attains 98.2% Teacher-Student fidelity, 0.94 Knowledge Retention Score, and 4.4x throughput increase with 82.7% reduction in the parameter and provides per-packet SHapely Additive exPlanation forensic explainability.
S. K, Menaka T K, N. R· 2026 4th International Confe...· 0 citations
A lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware.
Miracle Udurume, Vladimir V. Shakhov, Insoo Koo· Scientific Reports· 0 citations
