article · Scientific Reports
Internet of Medical Things networks require protection against cyberattacks that threaten patient care, but typical intrusion detection systems struggle to detect unseen traffic or adapt to new clinical settings without overwhelming resource-constrained edge gateways. To address this, the Multi-Head Feature-Expert Detection framework decomposes the detector by routing network traffic across three specialised classifiers using basic statistics. Because each expert scores every flow, divergence between their predictions serves as a novelty signal to identify unknown attacks without requiring additional models. Partitioning also allows individual experts to refit independently as conditions change. Tested on two public datasets, the architecture achieves a 98.55 percent macro-F1 score on RT-IoT2022, matching leading baselines. Although transferring to new environments requires some supervision, labelling just five percent of the target data recovers near-source accuracy, establishing an efficient route for edge-based clinical cybersecurity.
Medical devices connected to clinical networks are vulnerable to cyberattacks that can jeopardise patient safety. Traditional security tools often demand computational resources that small edge gateways lack, making them unable to spot novel threats or adjust to new hospital setups. This approach demonstrates how dividing detection tasks makes advanced threat detection and environmental adaptation feasible on lightweight network hardware.
This research could support cybersecurity software for hospital networks and medical device gateways, serving healthcare providers and medical equipment manufacturers. Having been evaluated on two public Internet of Medical Things datasets, the framework represents applied research tested in benchmark conditions. Commercial deployment would require progression from public data validation to integration and testing within operational hospital infrastructure.
AI-generated from the published abstract. Always read the original work before citing.
Internet of Medical Things (IoMT) networks face cyberattacks that can disrupt patient care, yet most intrusion detection approaches treat all flows as structurally equivalent, cannot flag previously unseen traffic, and offer no route to a new clinical environment. Supplying those two capabilities normally means adding models a gateway cannot host, so this study derives both from a decomposition of the detector itself and measures the cost. MHFED routes each flow by three elementary statistics to one of three specialised classifiers. Every expert scores every flow, so output divergence yields a novelty signal; routing partitions the data, so experts refit independently as the environment drifts. On two public IoMT datasets the decomposition proves accuracy-neutral: MHFED reaches 98.55% macro-F1 on RT-IoT2022, separable from neither the strongest baselines nor an ensemble of equal capacity. Partitioning also makes an otherwise prohibitive model family affordable to refit in place. The disagreement signal is the only novelty score needing no extra model that ranks unseen attacks above training traffic; established confidence- and entropy-based scores are rank-inverted, hence misleading. No method transfers without target supervision, though labelling 5% of the target domain restores near-source accuracy. The results quantify what edge-deployable novelty detection and cross-environment adaptation cost.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.1038/s41598-026-65467-8
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
