Adaptive Graph-Based Intrusion Detection for Internet of Medical Things (IoMT) Networks
Received: 16 January 2026 | Revised: 31 March 2026 | Accepted: 17 April 2026 | Online: 6 June 2026
Corresponding author: G. S. Chethan
Abstract
The widespread adoption of the Internet of Medical Things (IoMT) has significantly enhanced healthcare services but has also introduced increased vulnerability to sophisticated cyberattacks, highlighting the need for robust Intrusion Detection Systems (IDS). Traditional Machine Learning (ML) and Deep Learning (DL) methods often struggle with class imbalance and fail to effectively capture inter-device relationships and contextual dependencies, which limits their performance, particularly for fine-grained attack detection. To overcome these challenges, we propose the Adaptive Graph-based Hybrid Graph Convolutional Network Intrusion Detection System (AGH-GCN IDS). The system models IoMT devices and network flows as a graph, extracts attention-aware features using Graph Attention Networks (GAT), and employs a hybrid graph convolutional classifier enhanced with Attention-Weighted Graph Synthetic Oversampling (AWGSO) to address class imbalance. Extensive experiments on the CICIoMT2024 dataset demonstrate that AGH-GCN IDS achieves an accuracy of 99.98% for binary-class, 98.45% for 6-class, and 96.87% for 19-class classification, outperforming conventional ML and DL approaches. These results establish AGH-GCN IDS as a robust and high-performance solution for IoMT security, with future extensions targeting edge-cloud architectures for distributed and privacy-preserving detection.
Keywords:
IoMT security, Intrusion Detection System (IDS), Graph Convolutional Network (GCN), class imbalance, Graph Attention Network (GAT), CICIoMT2024References
D. Alshehri, N. Noman, R. Chiong, S. J. Miah, A. L. Sverdlov, and D. TM. Ngo, "Factors influencing the adoption of Internet of Medical Things for remote patient monitoring: A systematic literature review," Computers in Biology and Medicine, vol. 192, June 2025, Art. no. 110142.
K. G et al., "Enhancing IoT Resilience at the Edge: A Resource-Efficient Framework for Real-Time Anomaly Detection in Streaming Data," Computer Modeling in Engineering & Sciences, vol. 143, no. 3, pp. 3005–3031, June 2025.
M. F. Ali et al., "HCAP: Hybrid cyber attack prediction model for securing healthcare applications," Plos One, vol. 20, no. 5, May 2025, Art. no. e0321941.
M. Lucia Hernandez-Jaimes, A. Martínez-Cruz, K. Alejandra Ramírez-Gutiérrez, and E. Guevara-Martínez, "Enhancing Machine Learning Approach Based on Nilsimsa Fingerprinting for Ransomware Detection in IoMT," IEEE Access, vol. 12, pp. 153886–153897, 2024.
G. Balhareth and M. Ilyas, "Optimized Intrusion Detection for IoMT Networks with Tree-Based Machine Learning and Filter-Based Feature Selection," Sensors, vol. 24, no. 17, Sept. 2024, Art. no. 5712.
S. W. Nourildean, W. Mefteh, and A. M. Frihida, "DTXG-RF-based Intrusion Detection System for Artificial IoT Cyber Attacks," Engineering, Technology & Applied Science Research, vol. 15, no. 1, pp. 19610–19614, Feb. 2025.
A. Salehpour, M. Norouzi, M. A. Balafar, and K. SamadZamini, "A cloud-based hybrid intrusion detection framework using XGBoost and ADASYN-Augmented random forest for IoMT," IET Communications, vol. 18, no. 19, pp. 1371–1390, Dec. 2024.
R. H. Altaie and H. K. Hoomod, "An Intrusion Detection System using a Hybrid Lightweight Deep Learning Algorithm," Engineering, Technology & Applied Science Research, vol. 14, no. 5, pp. 16740–16743, Oct. 2024.
N. Faruqui et al., "SafetyMed: A Novel IoMT Intrusion Detection System Using CNN-LSTM Hybridization," Electronics, vol. 12, no. 17, Sept. 2023, Art. no. 3541.
S. Dadkhah, E. C. P. Neto, R. Ferreira, R. C. Molokwu, S. Sadeghi, and A. A. Ghorbani, "CICIoMT2024: A benchmark dataset for multi-protocol security assessment in IoMT," Internet of Things, vol. 28, Dec. 2024, Art. no. 101351.
A. Mezina, J. Nurmi, and A. Ometov, "Novel Hybrid UNet++ and LSTM Model for Enhanced Attack Detection and Classification in IoMT Traffic," IEEE Access, vol. 13, pp. 57589–57603, 2025.
S. Lipsa, R. K. Dash, and N. Ivković, "An interpretable dimensional reduction technique with an explainable model for detecting attacks in Internet of Medical Things devices," Scientific Reports, vol. 15, no. 1, Mar. 2025, Art. no. 8718.
A. Hafid, M. Rahouti, and M. Aledhari, "Optimizing Intrusion Detection in IoMT Networks Through Interpretable and Cost-Aware Machine Learning," Mathematics, vol. 13, no. 10, May 2025, Art. no. 1574.
J. Doménech, O. León, M. S. Siddiqui, and J. Pegueroles, "Evaluating and enhancing intrusion detection systems in IoMT: The importance of domain-specific datasets," Internet of Things, vol. 32, July 2025, Art. no. 101631.
R. Sharma, N. Sharma, and S. Nandan Mohanty, "Attack Detection in Internet of Medical Things Through Ensemble Machine Learning Models," Security and Privacy, vol. 8, no. 3, May 2025, Art. no. e70042.
L. Alsbatin, B. M. Alrifai, F. Zawaideh, and T. A. Alawneh, "Advancing IoMT Security: Machine Learning-Based Detection and Classification of Multi-Protocol Cyberattacks," Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, vol. 16, no. 2, pp. 228–247, June 2025.
H. Moudoud, Z. Abou El Houda, and B. Brik, "Advancing Privacy and Fairness in Healthcare Using Federated Edge Learning and Blockchain," IEEE Internet of Things Journal, vol. 12, no. 22, pp. 46129–46137, Nov. 2025.
"CIC IoMT dataset 2024." Canadian Institute for Cybersecurity, University of New Brunswick. [Online]. Available: https://www.unb.ca/cic/datasets/iomt-dataset-2024.html.
Downloads
How to Cite
License
Copyright (c) 2026 G. S. Chethan, N. S. Patil, GL Prakash, M. S. Muneshwara
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
