AI Based Intrusion Detection for IoMT Environments

Abstract

The growing adoption of Internet of Medical Things (IoMT) devices in healthcare environments has introduced significant cybersecurity challenges. These devices—ranging from wearable sensors to smart infusion pumps—transmit sensitive patient data across networks that are increasingly targeted by adversaries. While machine learning (ML)- based intrusion detection systems (IDSs) have shown promise in detecting network intrusions, their effectiveness is fundamentally constrained by the quality and representativeness of the training data. A critical limitation in current research is the reliance on individual, isolated datasets that capture only a narrow slice of the attack landscape. Models trained on such data often fail to generalize across different network topologies, device configurations, and attack vectors. This thesis addresses this gap by proposing and executing a systematic methodology for integrating multiple heterogeneous IoMT network traffic datasets into a single, unified, ML-ready dataset suitable for training robust IDS models. The methodology centers on the use of MIOTTA-NPT, a specialized network preprocessing tool that extracts a standardized set of statistical features from raw packet captures using a configurable window-based aggregation approach. By processing disparate datasets through a common feature extraction pipeline, the fundamental challenge of feature heterogeneity across datasets is resolved at the source. The integration pipeline further incorporates label harmonization across three granularity levels, data quality assurance procedures, feature scaling, and dataset provenance tracking to enable rigorous cross-domain evaluation. The resulting unified dataset preserves the diversity of the constituent sources— including varied attack types, network protocols, and device behaviors—while ensuring structural consistency required for effective model training. The Phase 1 release (8,011,534 window records with harmonized labels and scaled features) is publicly available in the CORA Research Data Repository. Three tree-based classifiers—Decision Tree, Random Forest, and XGBoost—were trained under both single-source and unified training regimes and validated on held-out test partitions as well as on HospNet26, a real hospital network traffic capture, to assess cross-domain generalizability. The experimental results show that unified-trained models reach macro-F1 ≥ 0.948 across both source domains, decisively outperforming single-source baselines (macro-F1 ≤ 0.74). Deployment on HospNet26 reveals a significant laboratory-to-clinic covariate shift— 90–96% of benign clinical traffic is misclassified as attack, primarily as DoS—providing the first quantitative measurement of this gap and motivating concrete recalibration strategies for safe operational deployment of IoMT intrusion detection systems.