Ghaida Balhareth

The Internet of Medical Things (IoMT) is becoming a vital part of modern healthcare, enabling ongoing patient monitoring and remote diagnosis. However, as more devices connect to the internet, healthcare systems become more vulnerable to serious security issues such as unauthorized access, patient data manipulation, and Man-in-the-Middle attacks. Conventional Intrusion Detection Systems (IDSs) often struggle with the unclear and uncertain characteristics of IoMT traffic, which leads to reduced detection accuracy and increased false alarms. To address these challenges, this paper proposes ML-FSID-FIS, a multi-level feature selection-based Intrusion Detection System that employs a fuzzy inference system (FIS) for classification in IoMT networks. The model combines multiple feature selection techniques into a three-stage multi-level feature selection strategy to improve detection efficiency and strengthen the security of IoMT networks. In the first stage, four feature selection techniques—Random Forest, XGBoost, ReliefF, and Mutual Information—are applied to identify the most relevant features. In the second stage, a frequency-based consensus strategy is utilized to extract consistently selected features from the four top-ranked sets. In the third stage, an ensemble refinement using bagging-based ranking is employed to rank the remaining features, resulting in the selection of the top five features. From these, three candidate 3-feature groups are formed and evaluated, and the best-performing group is selected as the final input set for the fuzzy logic classifier. The FIS produces a continuous risk score that is mapped to a binary decision using a validation-selected threshold. When the proposed method was tested on the WUSTL-EHMS-2020 dataset and compared with other recent work using the same dataset, it showed strong detection performance while maintaining a very low false positive rate of 0.3%. This study is distinguished by its integrated design, which combines a three-stage multi-level feature selection strategy with fuzzy logic-based intrusion classification to improve feature efficiency and support interpretable intrusion detection in IoMT.

The Internet of Medical Things (IoMTs) is a network of connected medical equipment such as pacemakers, prosthetics, and smartwatches. Utilizing the IoMT-based system, a huge amount of data is generated, offering experts a valuable resource for tasks such as prediction, real-time monitoring, and diagnosis. To do so, the patient’s health data must be transferred to database storage for processing because of the limitations of the storage and computation capabilities of IoMT devices. Consequently, concerns regarding security and privacy can arise due to the limited control over the transmitted information and reliance on wireless transmission, which leaves the network vulnerable to several kinds of attacks. Motivated by this, in this study, we aim to build and improve an efficient intrusion detection system (IDS) for IoMT networks. The proposed IDS leverages tree-based machine learning classifiers combined with filter-based feature selection techniques to enhance detection accuracy and efficiency. The proposed model is used for monitoring and identifying unauthorized or malicious activities within medical devices and networks. To optimize performance and minimize computation costs, we utilize Mutual Information (MI) and XGBoost as filter-based feature selection methods. Then, to reduce the number of the chosen features selected, we apply a mathematical set (intersection) to extract the common features. The proposed method can detect intruders while data are being transferred, allowing for the accurate and efficient analysis of healthcare data at the network’s edge. The system’s performance is assessed using the CICIDS2017 dataset. We evaluate the proposed model in terms of accuracy, F1 score, recall, precision, true positive rate, and false positive rate. The proposed model achieves 98.79% accuracy and a low false alarm rate 0.007 FAR on the CICIDS2017 dataset according to the experimental results. While this study focuses on binary classification for intrusion detection, we are planning to build a multi-classification approach for future work which will be able to not only detect the attacks but also categorize them. Additionally, we will consider using our proposed feature selection technique for different ML classifiers and evaluate the model’s performance empirically in real-world IoMT scenarios.