Explainable zero-day attack detection in IoMT using transformer-based time-series modeling

Area of Science:

• Cybersecurity
• Network Intrusion Detection Systems
• Internet of Medical Things (IoMT)

Background:

• Securing Internet of Things (IoT) and Internet of Medical Things (IoMT) networks presents challenges due to class imbalance, zero-day attacks, and deployment constraints.
• Existing intrusion detection systems (IDS) often struggle with feature engineering, ensemble methods, or data augmentation, leading to brittle performance across diverse datasets.
• Current IDS are typically closed-set, limiting their calibrated performance in real-world, open-set environments.

Purpose of the Study:

• To develop a novel intrusion detection system (IDS) that addresses severe class imbalance, zero-day attacks, and deployment constraints in IoMT networks.
• To shift towards protocol-aware sequence modeling and principled open-set calibration for robust and generalizable network security.
• To create an IDS capable of calibrated performance across heterogeneous datasets and practical deployment scenarios.

Main Methods:

• Introduced a Protocol State-Masked, Multi-scale Transformer architecture incorporating finite-state protocol constraints into the self-attention mechanism.
• Augmented the core architecture with auxiliary heads for next-state prediction and violation scoring, alongside an energy-based open-set module calibrated using Extreme Value Theory.
• Trained the model on the CICIoMT2024 dataset and evaluated its generalization on the independent WUSTL-EHMS-2020 testbed.

Main Results:

• Achieved 99.62% accuracy and 99.30% macro-F1 (binary) on CICIoMT2024; 98.90% accuracy and 98.40% macro-F1 (19-class) on CICIoMT2024.
• Demonstrated strong zero-day attack detection with an AUROC-OOD of 0.975 and FPR@95%TPR of 7.8%.
• Showcased excellent cross-dataset transferability on the unseen WUSTL-EHMS-2020 dataset, achieving ≈99.6% overall accuracy and ≈99.6% balanced TPR/TNR.

Conclusions:

• The proposed protocol-aware Transformer effectively mitigates class imbalance and curbs overfitting through structural supervision and calibrated open-set thresholds.
• Ablation studies confirmed the significant benefits of protocol masking and auxiliary heads in sharpening decision boundaries and reducing false alarms.
• The developed IDS delivers calibrated, high-fidelity detection that generalizes across diverse datasets, proving practical for real-world IoMT network deployment.