Multi-view learning and model fusion framework for threat detection in multi-protocol IoMT networks

Abstract

The Internet of Medical Things (IoMT) holds significant transformative potential for modern healthcare systems. It enables real-time patient monitoring and data insights for making informed clinical decisions. However, despite these advantages, IoMT networks face critical security challenges due to device resource constraints and heterogeneity. Existing research on IoMT security has primarily focused on data security concerns, overlooking the complexity and vulnerabilities arising from the heterogeneity of devices and communication protocols. Due to the complexity of IoMT network traffic and the high volume of data, advanced methods are necessary to enhance the security and reliability of these networks. Machine Learning (ML)-based methods provide effective techniques for detecting, preventing, and mitigating cyber threats. However, conventional centralized ML approaches are susceptible to privacy risks and vulnerabilities to single points of failure (SPoFs). This study proposes a cyberthreat detection method that employs a multi-view-based model fusion approach within a Federated Learning (FL) framework to enhance detection capabilities across multi-protocol IoMT networks. Federated learning is adopted to preserve data privacy by avoiding data transfer to central servers and mitigating SPoFs. The proposed method is evaluated using the CICIoMT2024 dataset featuring 17 Wi-Fi devices and 14 simulated MQTT devices with 18 attack scenarios across five categories (DoS, DDoS, spoofing, Recon, and MQTT). Overall, the method achieves superior threat detection using TabNet as the base learner and MLP as the meta-learner, with accuracies of 99.7 % and 99.4 % in binary and multi-class classification, respectively.