Hybrid Random Forest and Neural Network Intrusion Detection for IoMT Networks with Federated Differential Privacy
TL;DR
Federated learning with Gaussian differential privacy noise across five simulated IoMT nodes is implemented and a novel negative finding is reported: Batch Normalisation is incompatible with FedAvg weight averaging under DP noise because the averaged population statistics become incoherent, collapsing global accuracy to majority-class prediction in some rounds.
Abstract
Healthcare IoMT networks face a security problem that the published literature has not fully solved. Connected cardiac monitors, infusion pumps, and wearable sensors run lightweight protocols designed for efficiency, not for resisting attack. When those devices are compromised, the consequence is not merely a data breach. It is a patient safety event. Yet most published intrusion detection systems for this environment train on a single dataset from 2015 and have never seen ransomware, Mirai botnet traffic, or injection attacks. This gap is not trivial. An IDS that has never seen a threat category cannot detect it in deployment. We address this by combining three publicly available datasets UNSW-NB15, TON_IoT, and CICIoT2023 into a single training corpus of 5,751,048 network flow records covering 17 unified attack categories. On that data, we train a two-stage hybrid pipeline. A 200-tree Random Forest screens every flow in under one millisecond as normal or malicious. Flows flagged as malicious go to a five-layer Feed-Forward Neural Network that identifies which of sixteen specific attack categories the flow belongs to. Tested on 1,150,210 held-out flows, Stage 1 reached 99.55 percent binary accuracy and ROC-AUC of 0.9997. Stage 2 reached 99.45 percent weighted accuracy with F1-score of 0.9953. Privacy is the second problem we address. A shared IDS trained across hospitals requires pooling patient network data, which HIPAA and GDPR prohibit. We implemented federated learning with Gaussian differential privacy noise across five simulated IoMT nodes. No raw traffic record left any node during fifteen training rounds. The global federated model reached 96.46 percent accuracy in convergent rounds, a privacy cost of just 2.99 percentage points. We also report a novel negative finding: Batch Normalisation is incompatible with FedAvg weight averaging under DP noise because the averaged population statistics become incoherent, collapsing global accuracy to majority-class prediction in some rounds. The fix replacing BatchNorm with LayerNorm is identified and documented. Against seven published baselines, our system improves binary accuracy by 5.55 percentage points and multi-class accuracy by 14.05 percentage points. End-to-end inference takes under two milliseconds per flow on standard CPU hardware.