Trustworthy and ethical intrusion detection for healthcare internet of medical things using reinforcement learning and governance rules

Abstract

Healthcare Internet of Medical Things (IoMT) environments require intrusion detection systems that are accurate, safe, proportionate, and auditable. Conventional intrusion detection metrics such as accuracy and F1-score quantify classification performance but do not indicate whether automated response actions are clinically safe or operationally acceptable. This study proposes a governance-aware intrusion response framework for healthcare IoMT systems. The framework integrates a Random Forest flow-based detector, a Deep Q-Network triage agent, and an ethical rule engine informed by the NIST AI Risk Management Framework. The detector provides probabilistic and uncertainty-aware evidence, the triage agent selects one of four response actions, and the rule engine constrains unsafe actions through explicit governance rules, fallback decisions, and audit logs. The framework was evaluated using CIC-IoMT 2024 for in-domain assessment, a stratified CSE-CIC-IDS2018 sample for domain-shift stress testing, simulated Clinical Load Index sensitivity analysis, independent decision-quality metrics, and temporal streaming replay. In-domain DQN triage achieved a weighted F1-score of 0.978. Governance reduced benign blocking from 25.3% to 17.3%, showing that rule oversight reduced one form of potentially disruptive automated response. Corrected cross-domain evaluation showed substantial performance degradation, with CAS retention scores of 0.282 for the Random Forest baseline and 0.341 for the DQN triage model. In temporal streaming replay, performance declined after the transition to shifted traffic; however, the governed DQN produced lower mean decision harm cost than the unconstrained DQN under shifted replay windows, reducing harm cost from 0.502 to 0.434. These findings suggest that ethical rule oversight can improve selected decision-safety outcomes under controlled, uncertain, and shifted conditions. However, the results represent offline simulation evidence and should not be interpreted as validation for live hospital deployment.