Research Article

An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset

Volume: 6 Number: 4 July 16, 2026

An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset

Abstract

As Internet of Medical Things (IoMT) technologies become increasingly integrated into healthcare infrastructures, the attack surface of medical networks expands due to continuous communication among medical devices, patient monitoring systems, and hospital information infrastructures. Therefore, intrusion detection systems for IoMT environments should provide not only high classification performance but also interpretability, robustness, and computational feasibility. This study proposes an explainable machine learning framework for multi-class cyberattack detection in IoMT networks using the MedSec-25 IoMT Cybersecurity Dataset. The dataset consists of 554,534 flow records with 84 attributes and five classes: Benign, Exfiltration, Initial access, Lateral movement, and Reconnaissance. During preprocessing, identity-based and non-generalizable variables were removed, and only numerical flow-based features were used. Feature selection was performed using correlation-based reduction, Mutual Information, and Random Forest importance. The experimental design was extended by evaluating Decision Tree, Random Forest, XGBoost, LightGBM, Linear SVM, and Multi-Layer Perceptron models. In addition to the stratified 80/20 holdout test, stratified 5-fold cross-validation was applied to assess robustness. The best performance was obtained by the Random Forest model trained with the top 20 features selected by Mutual Information, achieving 99.06% accuracy, 95.89% macro precision, 96.26% macro recall, and 96.07% macro F1-score on the holdout test. In 5-fold cross-validation, the same model achieved 99.04% ± 0.04% accuracy and 96.03% ± 0.15% macro F1-score, indicating stable performance across folds. Class imbalance handling experiments showed that class-weighted Random Forest provided the best overall balance compared with no balancing, controlled SMOTE, and random undersampling. Port ablation analysis demonstrated that port-related variables were highly discriminative; however, the model still achieved strong performance using non-port numerical features, suggesting that it did not rely exclusively on port-specific traces. Global and local SHAP analyses revealed that port information, flow duration, packet density, and inter-packet timing statistics were the most influential factors in model decisions. The findings suggest that, under the evaluated MedSec-25 experimental setting, the proposed framework provides accurate, interpretable, and computationally efficient multi-stage attack detection for IoMT network traffic.

Keywords

References

  1. Dwivedi, R., Mehrotra, D., & Chandra, S. (2022). Potential of Internet of Medical Things (IoMT) applications in building a smart healthcare system: A systematic review. Journal of Oral Biology and Craniofacial Research, 12(2), 302–318. https://doi.org/10.1016/j.jobcr.2021.11.010
  2. Messinis, S., Temenos, N., Protonotarios, N. E., Rallis, I., Kalogeras, D., & Doulamis, N. (2024). Enhancing Internet of Medical Things security with artificial intelligence: A comprehensive review. Computers in Biology and Medicine, 170, 108036. https://doi.org/10.1016/j.compbiomed.2024.108036
  3. Si-Ahmed, A., Al-Garadi, M. A., & Boustia, N. (2023). Survey of machine learning based intrusion detection methods for Internet of Medical Things. Applied Soft Computing, 140, 110227. https://doi.org/10.1016/j.asoc.2023.110227
  4. Hernandez-Jaimes, M. L., Martinez-Cruz, A., Ramírez-Gutiérrez, K. A., & Feregrino-Uribe, C. (2023). Artificial intelligence for IoMT security: A review of intrusion detection systems, attacks, datasets and Cloud–Fog–Edge architectures. Internet of Things, 23, 100887. https://doi.org/10.1016/j.iot.2023.100887
  5. Hafid, A., Rahouti, M., & Aledhari, M. (2025). Optimizing intrusion detection in IoMT networks through interpretable and cost-aware machine learning. Mathematics, 13(10), 1574. https://doi.org/10.3390/math13101574
  6. Neto, E. C. P., Iqbal, S., Buffett, S., Sultana, M., & Taylor, A. (2025). Deep learning for intrusion detection in emerging technologies: A comprehensive survey and new perspectives. Artificial Intelligence Review, 58, Article 340. https://doi.org/10.1007/s10462-025-11346-z
  7. Almobaideen, W., Abdullah, M., Alam, U., Hussain, S. B., & Bouharrat, A. (2025). MedSec-25: Creating an IoMT dataset for a healthcare IoT environment. In 2025 7th International Conference on Blockchain Computing and Applications (BCCA) (pp. 628–634). IEEE. https://doi.org/10.1109/BCCA66705.2025.11229535
  8. Abdullah, M. (2025). MedSec-25: IoMT cybersecurity dataset [Data set]. Kaggle. Retrieved April 11, 2026, from https://www.kaggle.com/datasets/abdullah001234/medsec-25-iomt-cybersecurity-dataset

Details

Primary Language

English

Subjects

Circuits and Systems

Journal Section

Research Article

Publication Date

July 16, 2026

Submission Date

May 2, 2026

Acceptance Date

July 2, 2026

Published in Issue

Year 2026 Volume: 6 Number: 4

APA
Açıkgözoğlu, E. (2026). An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset. Engineering Perspective, 6(4), 526-542. https://doi.org/10.64808/engineeringperspective.1942777
AMA
1.Açıkgözoğlu E. An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset. engineeringperspective. 2026;6(4):526-542. doi:10.64808/engineeringperspective.1942777
Chicago
Açıkgözoğlu, Enes. 2026. “An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset”. Engineering Perspective 6 (4): 526-42. https://doi.org/10.64808/engineeringperspective.1942777.
EndNote
Açıkgözoğlu E (July 1, 2026) An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset. Engineering Perspective 6 4 526–542.
IEEE
[1]E. Açıkgözoğlu, “An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset”, engineeringperspective, vol. 6, no. 4, pp. 526–542, July 2026, doi: 10.64808/engineeringperspective.1942777.
ISNAD
Açıkgözoğlu, Enes. “An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset”. Engineering Perspective 6/4 (July 1, 2026): 526-542. https://doi.org/10.64808/engineeringperspective.1942777.
JAMA
1.Açıkgözoğlu E. An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset. engineeringperspective. 2026;6:526–542.
MLA
Açıkgözoğlu, Enes. “An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset”. Engineering Perspective, vol. 6, no. 4, July 2026, pp. 526-42, doi:10.64808/engineeringperspective.1942777.
Vancouver
1.Enes Açıkgözoğlu. An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset. engineeringperspective. 2026 Jul. 1;6(4):526-42. doi:10.64808/engineeringperspective.1942777

download?token=eyJhdXRoX3JvbGVzIjpbXSwiZW5kcG9pbnQiOiJqb3VybmFsIiwib3JpZ2luYWxuYW1lIjoiQ2l0ZVNjb3JlMjAyNV9FbmdpbmVlcmluZ19QZXJzcGVjdC5wbmciLCJwYXRoIjoiMjk0YS81N2EyLzlmYzcvNmEyMDA1NTk1OTk0NjMuMTIyOTg1NTEucG5nIiwiZXhwIjoxNzgwNDg3MDE3LCJub25jZSI6ImFjOTI3ZGIxMTUyNGUwZWRhYTlmMzc4ZDk4ZWIwOWQ0In0.VU0eXdFjkzGH_RYBvG3PsXcGoypETO7r1qIe7dMExbU