A Binning-Based Approach for Intrusion Detection and Attack Classification in Internet of Medical Things Networks

Internet of Medical Things (IoMT) is redefining modern healthcare by enabling the continuous collection, transmission, and analysis of patient data through interconnected medical devices, wearables, and hospital systems. These advantages, however, extend and complicate the e-health attack surface, the effects of which are devastating as they impact human health and privacy. Reports indicate a rise in IoT-based cyberattacks targeting medical infrastructures and sensitive data regarding patients’ health; consequently, Intrusion Detection and Prevention Systems (IDS/IPS) have become essential components of secure IoMT architectures. IoMT networks generally have different characteristics from traditional networks and require ad hoc solutions. Most IDS/IPS models in the literature rely on deep learning architectures that, while achieving high accuracy, are unsuitable for real-time operation in resource-constrained IoMT environments. The resulting gap between recognition performance and solution deployability leaves IoMT networks lacking real-world applicable approaches. To address this gap, this paper introduces a lightweight hybrid IDS/IPS framework that combines decision tree models with a compact neural network. The neural network is enhanced through a supervised binning mechanism designed to handle non-continuous and heterogeneous IoMT data effectively. Experiments on three widely adopted IoMT datasets (CICIoMT 2024, IoMT TrafficData, and WUSTL EHMS 2020) show that the proposed model achieves accuracy and F1-weighted scores exceeding 0.99, while processing 30,000–100,000 samples per second. Compared to state-of-the-art deep models, our approach maintains comparable or superior detection capability with significantly lower computational cost. The model proved to be particularly robust and effective in attack detection (binary classification) and attack classification (multiclass classification) tasks.