FedHEAL-IoMT: A Federated Hierarchical Evidential Adaptive Learning Framework for Zero-day DDoS Detection in Internet of Medical Things Networks

Abstract

Distributed denial-of-service (DDoS) traffic dominates the attack taxonomy of current Internet of Medical Things (IoMT) testbeds, and federated learning (FL) has become the accepted way of training detectors without moving patient-adjacent traffic off hospital premises.Existing federated IoMT detectors nevertheless combine conventional averaging with an off-the-shelf classifier and report results on independent and identically distributed partitions, so their published accuracy reveals little about the conditions a deployed hospital federation meets: attack variants absent from the training distribution, gradual drift in traffic composition, compromised gateways that poison the aggregate, and devices too constrained to host the full model.This paper presents FedHEAL-IoMT, a three-tier framework treating those conditions as one coupled problem.An evidential head emits Dirichlet concentration parameters whose total uncertainty acts as an open-set alarm and, through an exponentially weighted shift statistic, as a label-free drift trigger; a trust-weighted rule gates outlying updates by geometric-median deviation, evaluated inside a two-server secure-computation protocol that reveals no individual update, distance or trust score, before a differentially private secure sum; and a normalized-cost rule places the split-learning cut layer per device class.Validation spans CICIoMT2024, WUSTL-EHMS-2020, ECU-IoHT and CICIoT2023.On CICIoMT2024 FedHEAL-IoMT attains 99.41% accuracy under homogeneous partitions against 99.35% for the strongest baseline, a difference of 0.06 points lying inside the seed spread, while raising macro-F1 by 4.57 points at Dirichlet α = 0.1, open-set area under the receiver operating characteristic curve by 4.31 points over the strongest zero-day baseline, and accuracy under 30% non-adaptive malicious gateways by 5.34 points over the strongest robust comparator, FedMADE, and 8.01 over Krum, at 71.9% lower peak resident memory measured on the Raspberry Pi 4B gateway platform.Code, configurations, seeds and per-seed results are released publicly.