DL-BASED INTRUSION DETECTION FOR IOMT: A COMPARATIVE ANALYSIS OF EMBED-NET, CONV-NET-SVM, AND DEEP-SVM-NET

Abstract

The swift development of IoMT technology has led to the ability of continuously track ing patients, automating clinical operations, and facilitating interaction between connected devices in contemporary healthcare settings. While these interrelated processes greatly im prove medical efficiency and accessibility, there are major cybersecurity risks present as well. Typically, medical devices have low computing power, run outdated firmware, and lack sophisticated protection systems; therefore, they become easy targets for diverse cy ber attacks such as DoS [7], reconnaissance, spoofing, and data manipulation attacks. It turns out to be hard to cope with dynamic and sophisticated IoMT traffic using common IDS technologies [8], like signature-based IDS and traditional machine learning techniques. The limitations of the existing systems in terms of poor adaptiveness, simplified feature representation, and high levels of false negatives prove the necessity of further research in creating smart IDS techniques. This study introduces a 3-part deep learning solution specifically for an IoMT IDS Embed-Net, Conv-Net-SVM, and Deep-SVM-Net. Each model is a solution to specific se curity problems with IoMT environment. Embed-Net is an approach that embeds device identifiers, flags, and protocol attributes into dense models that are learned from the data and enables these models to represent subtle interactions between heterogeneous network traffic. The Conv-Net-SVM performed convolutional feature extraction followed by a Sup port Vector Machine (SVM) classifier, fusing the advantages of CNN, which is capable of learning the structs in the flow with good margin-based decision boundaries of SVM. Deep SVM-Net is an output layer based on SVM that exploits a novel approach to deep neural net that functions well in separating benign and malicious traffic and simultaneously has a low computational load for resource constrained medical devices. Several IoT-related datasets that included the various cyber-attack patterns were first preprocessed for standardization of scaling, transformations to ordinal encoding, feature selection based on covariance, and SMOTE balancing before training and validation were performed on the datasets, each using a cross validation strategy that ensured stable and generalizable models. All three exhibited excellent intrusion detection results with par ticularly good overall accuracy and low false-negative rates from Embed-Net, outstanding capability in learning attack signatures with high spatial correlations from ConvNetSVM, and superior intrusion detection real-time efficiency with highly reliable binary separation from Deep-SVM-Net. The results collectively point to the superiority of the deep learn ing architecture for improving the security of IoMT, which efficiently adapts to mixed-type features, to an imbalanced dataset, and to medical operational constraints.