A Hybrid Framework for IoMT Threat Detection and Mitigation

Abstract

The Internet of Medical Things (IoMT) is transforming healthcare through continuous monitoring, remote diagnostics, and data-driven care. Still, pervasive connectivity expands the attack surface and elevates risks of data breaches, ransomware, and service disruption with direct patient-safety implications. This paper proposes a comprehensive, multi-layered IoMT security framework that unifies edge/fog intrusion detection with privacy-preserving and integrity-assurance mechanisms across sensor, network, and cloud tiers. The detection plane combines a hybrid deep learning architecture, Convolutional Neural Networks with Long Short-Term Memory (CNN-LSTM) for real-time traffic analysis with high recall at the edge/fog, and ensemble machine learning models (XGBoost, LightGBM, and Deep Neural Networks) for static and dynamic malware/ransomware analysis at aggregation layers. To strengthen integrity, non-repudiation, and secure pr ovenance, the framework integrates a lightweight private blockchain; for privacy and scalability, it supports federated learning to enable cross-institutional model updates without centralising protected health information. A priori STRIDE threat modelling guides design choices and control placement, while the response plane uses adaptive policies to isolate compromised devices and sustain clinical workflows automatically. On the CICIoMT2024 benchmark and SDN-integrated simulations, the framework achieves over 99% accuracy, recall, and F1-score for intrusion and malware detection, with 99.60% accuracy and an F1-score of 0.9966 using XGBoost, and maintains 99.82% service availability during automated containment. The approach aligns with risk and safety practices in ISO 14971 and IEC 81001-5-1, and is consistent with FDA/IMDRF expectations, while anticipating future extensions in quantum-resistant cryptography and energy-aware deployment. By fusing AI-driven detection, distributed trust, and proactive threat modelling, the framework delivers a resilient, scalable, and regulation-conscious security foundation for life-critical IoMT ecosystems.