2.1. Deep learning for intrusion detection

Network intrusion detection has been improved in many ways by deep learning, with CNN allowing the extraction of spatial features by analyzing packet payloads [16] and LSTMs allowing the modeling of temporal features in sequential traffic [18]. Hybrid architecture, such as fusion architecture frequently proposed by Thakkaretal. [20] that combines dimensionality reduction with LSTMs, and federated learning architecture where models are trained on a sequence of packets by Wuet al. [21] have also been proposed graph neural networks. Transformer-based architecture represents the new frontier, where Xi et al. [7] presents multi scale detection models, and Al Qathrady et al. [17] present SACNN-IDS to Industrial IoT applications.

2.2. Attention mechanisms in cybersecurity

Attention helps the models to pay attention to the features that are relevant to detecting threats. Multi-head attention considers multiple aspects of input concurrently [22], whereas Djaidja et al. [6] had shown attention-RNN combinations in early intrusion detection. Self-attention is useful when dealing with a long-range dependency in traffic sequences [9]. Graph attention networks follow the relationships of network entities that are complex in nature as depicted by Zhao et al. [23], whereas Ghosh et al. [24] created temporal attention networks to detect intrusions in IoT.

2.3. Healthcare IoT security

The IoT security of healthcare poses special issues because of the sensitive medical information and patient safety concerns. Khan and Alkhathami [1] emphasized that special mechanisms of detecting medical device traffic patterns were necessary. Balhareth and Ilyas [2] suggested optimized IDS of IoMT based on tree-based learning, and Alalwany et al. [25] suggested stacking ensemble methods of real-time IoMT detection. Freyer et al. [3] stressed the importance of the security assessment in the regulatory submissions, and Naghib et al. [4] also found interpretability as one of the essential gaps in the current IoMT intrusion detection systems. XAI in cybersecurity responds to the demand of making transparent decisions. Gaspar et al. [14] studied the use of LIME and SHAP to explain intrusion detection decisions, and Arreche et al. [15] tested black-box XAI frameworks, and later created XAI-IDS [19]. The directions of future XAI research were mapped by Pawlicki et al. [26], and transparency was stressed on in practical implementation by Mohale and Obagbuwa [27].

Explainability is a serious requirement in healthcare. Rosenbacke et al. [10] investigated the impact of XAI on clinician trust, Kim et al. [28] reviewed the topic of XAI-based clinical decision support systems, and B¨urger et al. [11] identified the lack of alignment between the research and clinical translation. Healthcare-specific methods of explanations have been suggested by Metta et al. [29], and Sadeghi et al. [12] and Mienye et al. [13] address them comprehensively.

Recent literature has introduced further advances specifically addressing explainable IoMT intrusion detection. Sharma and Shambharkar [30] proposed Multi-attention DeepCRNN, a deep convolutional-recurrent neural network augmented with multi-head attention mechanisms, demonstrating efficient and explainable threat classification in IoMT environments with improved interpretability over single-attention baselines. Sharma and Shambharkar [31] introduced a multi-layered security architecture for IoMT systems integrating dynamic key management, decentralized storage, and a dependable intrusion detection framework, addressing both cybersecurity robustness and patient data integrity across heterogeneous clinical networks. Sharma and Shambharkar [32] explored advanced deep learning-based frameworks for transforming IoMT security, leveraging transformer-based detection architectures to achieve scalable, accurate, and adaptive threat classification across diverse medical device traffic profiles. These works collectively reinforce the importance of combining high-accuracy detection with interpretability and architectural scalability — the same imperatives that motivate the design of MedDefender-MHAN.

2.4. Research gap

Although there has been progress in every area, there is no current model that fits the description of high detection, real time processing, intrinsic explainability and optimization to healthcare applications. The existing methods either compromise interpretability to achieve good performance or they offer post hoc explanations which do not capture the temporal dynamics of attacks. The gap of MedDefender-MHAN is closed by the design of the architecture to incorporate explainability as a fundamental element without compromising the latest performance in detecting performance.

3.1. System overview

The proposed MedDefender-MHAN framework will have five interrelated modules: (1) Data Preprocessing and Normalization Module, (2) Hierarchical Feature Extraction Module, (3) Multi-Head Attention Encoder, (4) Threat Classification Module, and (5) Explainability Generation Module. Fig 2 shows the overall network of the system.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 2. Detailed architecture of MedDefender-MHAN illustrating inter-module interactions.

Raw IoMT network traffic is normalized and reshaped into temporal sequences before being processed by two parallel streams: a 1D-CNN stream for local spatial feature extraction and a Transformer stream for long-range temporal dependency modeling. Outputs are fused and passed through the Multi-Head Attention Encoder (H parallel heads), where attention weight matrices are simultaneously used for threat classification via a softmax layer and reused without modification by the Explainability Generation Module to produce gradient-weighted attention heatmaps and feature importance attribution maps. This shared attention mechanism ensures architectural consistency between detection decisions and their human-interpretable explanations, requiring no external post-hoc XAI pipeline.

https://doi.org/10.1371/journal.pone.0346677.g002

The data stream starts with the raw network traffic packets that are gathered on healthcare IoT devices, and they are preprocessed so that they can extract the features of interest and normalize the values. The hierarchical feature extraction module is a processing module that takes the normalized features, concurrently, using parallel CNN and transformer streams, to reflect local spatial patterns and global time dependencies. Multi-head attention encoder uses parallel attention on the extracted features, producing rich representations, which highlight information of threat value. The classification module is the one that yields final threat predictions and explainability module is the one that gives human interpretable explanation based on attention weights, and gradient information

The interaction between MedDefender-MHAN’s core components follows a structured, hierarchical information flow designed to preserve both local feature granularity and global temporal context while maintaining end-to-end explainability. As illustrated in Fig 2, raw network traffic features first pass through the Data Preprocessing and Normalization Module, where Min-Max scaling and Z-score normalization standardize the 78-dimensional (CICIDS2017) or 44-dimensional (TON_IoT) input vectors into uniform representations suitable for deep learning ingestion. These normalized vectors are reshaped into temporal sequences and fed simultaneously into two parallel processing streams within the Hierarchical Feature Extraction Module: (i) a Convolutional Feature Extraction Stream comprising stacked 1D convolutional layers with ReLU activations and max-pooling, which captures local spatial correlations and short-range traffic burst patterns within the feature space; and (ii) a Transformer-Based Contextual Stream employing multi-layer positional encoding and self-attention to model long-range temporal dependencies across sequential traffic flows. The outputs of both streams are concatenated through a Feature Fusion Layer that produces a unified, dual-perspective feature representation, preserving spatial locality alongside global contextual awareness.

This fused representation is then forwarded to the Multi-Head Attention Encoder, which applies H parallel attention heads — each independently attending to distinct subspaces of the fused feature vector. Formally, each head computes scaled dot-product attention over learned Query (Q), Key (K), and Value (V) projections, and the concatenated multi-head output is linearly projected to produce the final attention-enriched representation. Critically, the attention weight matrices generated at this stage are not discarded after classification — they are reused directly by the Explainability Generation Module as intrinsic attribution maps, eliminating the need for computationally expensive post-hoc methods such as SHAP or LIME. The Threat Classification Module receives the attention-encoded representation and applies a fully connected softmax layer to produce class probability distributions across 14 attack categories (CICIDS2017) or 9 IoT-specific threat types (TON_IoT). Simultaneously, the Explainability Module aggregates and normalizes the multi-head attention weights to generate feature-level importance scores and temporal attack attribution heatmaps, which are presented to clinical security analysts through a human-interpretable alert interface. This tightly coupled design ensures that MedDefender-MHAN’s detection decisions and their corresponding explanations are always architecturally consistent — produced by the same attention mechanism — rather than generated by a separate, independently approximated explanation pipeline.

3.2. Data preprocessing and normalization

represents the -dimensional feature vector and denotes the class label for threat categories.

The preprocessing pipeline applies the following transformations. First, we perform min-max normalization to scale features to the range:

(1)

where prevents division by zero, and indexes the feature dimension.

For features exhibiting heavy-tailed distributions, we apply log transformation prior to normalization:

(2)

The preprocessed features are then reshaped into a sequence format suitable for temporal modeling:

(3)

where represents the temporal window length and denotes the features per time step.

Feature selection follows a two-stage process. In the first stage, CICFlowMeter is used to extract 78 bidirectional flow features from raw PCAP files for CICIDS2017, and 44 features for TON_IoT, including packet length statistics, inter-arrival times (IAT), flow duration, protocol flags, and byte counts. In the second stage, features with near-zero variance (threshold σ² < 0.001) are removed, and highly correlated feature pairs (Pearson |r| > 0.95) are pruned using greedy selection, retaining the feature with higher mutual information with the class label. The resulting feature sets consist of 72 features for CICIDS2017 and 41 features for TON_IoT. For CICIDS2017, the 6 features removed due to near-zero variance (σ² < 0.001) include: ‘Bwd PSH Flags,’ ‘Fwd URG Flags,’ ‘Bwd URG Flags,’ ‘CWE Flag Count,’ ‘Fwd Avg Bytes/Bulk,’ and ‘Bwd Avg Bulk Rate.’ An additional 0 features were removed after Pearson correlation pruning, resulting in 72 final features. For TON_IoT, 3 features were removed due to near-zero variance (‘Fwd URG Flags,’ ‘Bwd URG Flags,’ ‘URG Flag Count’) and 0 due to correlation pruning, yielding 41 final features. These removed features were consistently near-constant across both benign and attack traffic and contributed negligible discriminative information as confirmed by mutual information scores < 0.001 relative to the class label. Heavy-tailed features (skewness > 2.0, identified via Scipy stats) undergo log-transformation per Eq. (2) prior to min-max normalization per Eq. (1).

3.3. Hierarchical feature extraction module

The hierarchical feature extraction module employs a dual-stream architecture processing inputs through parallel CNN and transformer pathways.

3.3.1. CNN stream.

The CNN stream extracts local spatial features through a series of convolutional layers. The first convolutional layer is defined as:

(4)

where represents the learnable filter weights with kernel size and output channels, denotes the convolution operation, and is the bias term.

Subsequent convolutional layers follow the same pattern:

(5)

We apply batch normalization after each convolutional layer to stabilize training:

(6)

where and are the batch mean and variance, and , are learnable parameters.

Max pooling is applied to reduce spatial dimensions:

(7)

where is the pooling window size.

3.3.2. Transformer stream.

The transformer stream captures long-range temporal dependencies through self-attention. First, positional encodings are added to preserve sequence order:

(8)(9)

where is the position and is the dimension index.

The input with positional encoding is:

(10)

The transformer encoder applies multi-layer self-attention:

(11)

Each transformer layer consists of multi-head self-attention and feed-forward networks with residual connections:

(12)(13)

The feed-forward network is defined as:

(14)

3.3.3. Feature fusion.

The outputs from CNN and transformer streams are fused through concatenation followed by a learnable projection:

(15)

where denotes concatenation and projects to the desired dimensionality.

3.4. Multi-head attention encoder

The multi-head attention encoder is the core component of MedDefender-MHAN, enabling the model to attend to different aspects of the input simultaneously. Given the fused features , we compute queries, keys, and values:

(16)

where are learnable projection matrices.

The scaled dot-product attention is computed as:

(17)

For multi-head attention with heads, each head computes:

(18)

The heads are concatenated and projected:

(19)

where is the output projection matrix.

The attention weights matrix captures temporal dependencies:

(20)

These attention weights are preserved for explainability generation.

3.5. Threat classification module

The classification module converts the attention enhanced features into threat predictions. Aggregation of time information: global average pooling:

(21)

The pooled features pass through fully connected layers:

(22)

(23)

The final classification layer produces logits:

(24)

Softmax activation yields class probabilities:

(25)

The model is trained using cross-entropy loss:

(26)

To address class imbalance common in intrusion detection datasets, we employ focal loss:

(27)

where is the focusing parameter.

3.6. Explainability generation module

The explainability module produces human interpretable explanations with the help of analysis of attention patterns and calculating gradient-weighted importance scores.

3.6.1. Attention-based feature importance.

(28)

Feature importance scores are derived from the attention weights:

(29)

3.6.2. Gradient-weighted attention mapping.

To provide more precise explanations, we compute gradient-weighted attention maps using the class activation approach:

(30)

where is the score for class c, is the attention at position in head , and is a normalization constant.

The gradient-weighted attention map is:

(31)

3.6.3. Temporal pattern identification.

Temporal attack patterns are identified by analyzing attention flow across time steps:

(32)

The explainability score for a detected threat combines feature importance and temporal patterns:

(33)

where balances the contribution of each component.

3.7. Algorithmic implementation

Algorithm 1 presents the complete training procedure for MedDefender-MHAN, while Algorithm 2 details the inference and explanation generation process.

Algorithm 1. MedDefender-MHAN Training Procedure.

INPUT:

D = {(xᵢ, yᵢ)}ᵢ₌₁N — Training dataset

η, E, B — Learning rate, Epochs, Batch size

OUTPUT:

Θ — Trained model parameters

Step 1: Initialize model parameters Θ using Xavier initialization

Step 2: Initialize Adam optimizer with learning rate η

Step 3: Shuffle dataset D

Step 4: For epoch = 1 to E do

Step 5:  For each mini-batch B ⊂ D do

Step 6   Preprocess batch: Bˆ ← Normalize(B) using Equation (1)

Step 7:   Reshape to sequences: X ← Reshape(Bˆ) using Equation (3)

Step 8:   Extract CNN features: F_CNN ← CNN_Stream(X)

Step 9:   Extract Transformer features: F_Trans ← Trans_Stream(X)

Step 10:    Fuse features: F_fused ← Fusion(F_CNN, F_Trans) using Equation (15)

Step 11:    Apply multi-head attention: F_attn, A ← MHA(F_fused)

Step 12:    Compute predictions: ŷ ← Classify(F_attn) using Equation (25)

Step 13:    Compute focal loss: L ← FocalLoss(ŷ, y) using Equation (27)

Step 14:   Backpropagate: ∇_Θ L

Step 15:   Update parameters: Θ ← Θ − η· ∇_Θ L

Step 16:  End for (mini-batch)

Step 17:  Validate on held-out set

Step 18:  Apply learning rate decay if validation loss plateaus

Step 19: End for (epoch)

Return: Θ

Algorithm 2. Inference and Explanation Generation.

1.Test sample ,

2.Ttrained parameters ,

3.Explainability weight

4.Prediction ,

5.Explanation

6.Preprocess:

7.Normalize() Reshape:

8.Reshape()

9.Forward pass through feature extraction

10.CNN_Stream()

11.Trans_Stream()

12.Fusion(, )

13.Obtain attention-enhanced features and weights ,

14.

15.MHA()

16.Compute prediction:

17.Classify()

18.Compute average attention:

19.Compute feature importance using [33]

20.Compute gradient-weighted map:

21.GradCAM(, )

22.Identify temporal patterns using [34]

23.Generate explanation:

24.

25.End if

26.End for

27.Return ,

[Cross-reference — Hyperparameter Configuration]: All training and architectural hyperparameters for MedDefender-MHAN — including batch size, learning rate (η), number of attention heads (H), model dimension (d_model), CNN layer count, temporal window length (T), focal loss parameter (γ), and explainability weight (λ) — are fully documented in Table 2 (Section 4.2). Values were independently optimized for CICIDS2017 and TON_IoT via 5-fold cross-validated grid search. Readers are directed to Table 2 before proceeding to the experimental results.

Download:

• PNG
  larger image
• TIFF
  original image

Table 2. Hyperparameter Configuration for MedDefender-MHAN.

https://doi.org/10.1371/journal.pone.0346677.t002

3.8. Complexity analysis

We compare the time and space requirements of the computational complexity of MedDefender-MHAN.

3.8.1. Time complexity.

The time complexity of each component is as follows:

The CNN stream with layers, kernel size , and channels has complexity:

(34)

The transformer stream with self-attention has quadratic complexity in sequence length:

(35)

The multi-head attention encoder contributes:

(36)

The total time complexity is:

(37)

3.8.2. Space complexity.

The space complexity is dominated by the attention weight matrices:

(38)

For practical deployment, with , , , the model requires approximately 2.3 million parameters, enabling real-time inference on standard hardware.

3.9. Real-time IoMT testbed configuration

To validate the real-world applicability of MedDefender-MHAN under authentic healthcare IoT conditions, we configured a representative IoMT testbed comprising three hardware tiers. At the edge tier, a Raspberry Pi 4 Model B (4GB RAM) serves as a constrained medical IoT node, simulating wearable sensors and bedside monitors transmitting network traffic. At the fog tier, an NVIDIA Jetson Nano (4GB) hosts the MedDefender-MHAN inference engine, performing threat classification and attention-based explanation generation at 2.3 ms per sample. At the gateway tier, a smart health gateway running Ubuntu 22.04 LTS on an Intel NUC aggregates traffic from edge nodes and forwards processed flow records to the fog inference layer. Network traffic between devices is captured using tcpdump and processed with CICFlowMeter to extract the 78-feature vectors (CICIDS2017) and 44-feature vectors (TON_IoT) consumed by MedDefender-MHAN. Detected threats and attention-weighted explanations are forwarded in real time to a hospital security dashboard for analyst review.

3.10. End-to-end mathematical formulation and architectural distinction

To describe the proposed MedDefender-MHAN architecture in a formal way, this subsection describes a succinct end-to-end mathematical formulation of the architecture and clearly makes the difference between the proposed architecture and traditional models of intrusion detection, based on transformers.

Let denote the preprocessed and reshaped network traffic input sequence, where represents the temporal window length and denotes the feature dimension per time step. The overall MedDefender-MHAN model can be expressed as a hierarchical function composition:

(39)

where denotes the convolutional spatial feature extractor, represents the transformer-based temporal encoder, is the feature fusion operator, corresponds to the multi-head attention encoder, and denotes the final threat classification function.

3.10.1. Dual-stream hierarchical encoding.

In contrast to vanilla transformer-based models of IDS, which use a single self-attention encoder to learn the spatial and temporal relationship together, MedDefender-MHAN uses a dual-stream (parallel) encoding design. The CNN stream does the localized spatial features extraction:

(40)

tracing short range correlations and burst-like traffic signatures that are typical of healthcare IoT communications. Simultaneously, the transformer stream captures long-range temporal dependencies with the help of self-attention:

(41)

that allows the model of sustained attack patterns like low-rate intrusion and backdoor activities.

A projection between the two representations is learnt:

(42)

thereby preserving complementary spatial and temporal information prior to attention-based reasoning.

3.10.2. Multi-head attention with explainability preservation.

Given the fused representation , the multi-head attention encoder computes attention-enhanced features:

(43)

where denotes the set of attention weight matrices produced by the attention heads.

A key architectural distinction of MedDefender-MHAN is that these attention weights are explicitly preserved and reused for explanation generation rather than being discarded after feature aggregation, as is typically done in standard transformer-based IDS architectures.

3.10.3. Gradient-weighted attention-based explainability.

To ensure consistency between detection and explanation, MedDefender-MHAN derives explanations directly from the internal attention mechanisms. For a predicted threat class , gradient-weighted attention importance is computed as:

(44)

where denotes the attention weight at position in head , is the class score, and is a normalization constant.

The resulting explanation map is obtained as:

(45)

which highlights the temporal regions and feature interactions that most strongly influence the model’s decision.

3.11. Dataset description

To assess MedDefender-MHAN, we use two benchmark datasets related to intrusion detection that are publicly available and commonly used in the intrusion detection research.

3.11.2. TON_IoT dataset.

The TON_IoT data set is a dedicated data set of the IoT and Industrial IoT security research that is composed of network traffic of heterogeneous IoT networks such as smart home devices, industrial sensors, and edge computing platforms.

Dataset Link: https://research.unsw.edu.au/projects/toniot-datasets.

The dataset consists of 461,043 labeled samples (including 9 types of attacks applicable to the IoT setting): Scanning, DoS, DDoS, Ransomware, Backdoor, Injection, XSS, Password, and MITM attacks.

The main peculiarities of the two data sets that were used in our experiments are summarized in Table 1.

Download:

• PNG
  larger image
• TIFF
  original image

Table 1. Summary of Datasets Used for Evaluation.

https://doi.org/10.1371/journal.pone.0346677.t001

To further evaluate the generalizability of MedDefender-MHAN on contemporary threat environments, we additionally include the CIC-IoT-2023 dataset [35], a recent benchmark released by the Canadian Institute for Cybersecurity. This dataset captures network traffic from 105 IoT devices and encompasses 18 attack categories including DDoS, DoS, Reconnaissance, Web-based, Brute Force, Spoofing, and MQTT-based protocol attacks, making it representative of current real-world IoMT attack surfaces. The dataset is publicly available at: https://www.unb.ca/cic/datasets/iotdataset-2023.html.

4.1. Experimental setup

4.1.3. Evaluation metrics.

We evaluate model performance using standard classification metrics:

Accuracy measures overall classification correctness:

(46)

Precision quantifies the proportion of true positives among positive predictions:

(47)

Recall (Sensitivity) measures the proportion of actual positives correctly identified:

(48)

F1-Score provides the harmonic mean of precision and recall:

(49)

For explainability evaluation, we measure alignment with expert annotations using:

(50)

where and denote features identified by the model and domain experts, respectively.

4.2. Training dynamics

Fig 3 shows the training and validation loss curve of MedDefender-MHAN on both data sets. The model converges stably without overfitting. Validation loss accurately follows training loss as the model is being optimized.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 3. Training and validation loss curves on MedDefender-MHAN on CICIDS2017 and TON_IoT datasets.

The model converges after 60 epochs on CICIDS2017 and 50 epochs on TON_IoT with the training and validation loss curves having a small difference suggesting strong generalization.

https://doi.org/10.1371/journal.pone.0346677.g003

Precision evolution throughout the training process is shown in Fig 4; here one can see that the accuracy is rapidly increasing in the first epochs and then it is gradually getting more refined as the model is exposed to more specific attack patterns.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 4. Training and validation accuracy curves indicating the learning curves of MedDefender-MHAN.

The model attains 99% validation on CICIDS2017 after the 45th epoch and 98 percent on TON_IoT after the 40th epoch.

https://doi.org/10.1371/journal.pone.0346677.g004

4.3. Detection performance

Table 3 summarizes the overall detection of MedDefender-MHAN on the 2 benchmark datasets. The accuracy, precision, recall, and F1-score remain high despite repeated use, which means that the given model performs consistently across all metrics. The small performance gap between CICIDS2017 and TON_IoT indicates strong cross-domain scalability.

Download:

• PNG
  larger image
• TIFF
  original image

Table 3. Overall Detection Performance of MedDefender-MHAN.

https://doi.org/10.1371/journal.pone.0346677.t003

To determine whether or not the experimental improvements are systematic as opposed to stochastic, paired statistical tests of significance were performed in repeated experimental experiments. The results of the paired t-test prove that the increases in accuracy and F1-score on CICIDS2017 and TON_IoT are statistically significant (p < 0.01). This statistical validation indicates that MedDefender-MHAN can stabilize the performance improvement based on architectural design decisions and not due to randomization or data-specific behavior.

4.3.1. Per-class performance.

Tables 4 and 5 that report the results per class, shed more light on how the model behaves in situations where the attacks represent different categories. MedDefender-MHAN has close-to-perfect detection performance on high-volume attacks, including DoS, DDoS, and PortScan, and is highly sensitive to burst-based and temporally dense traffic profiles on CICIDS2017. This action indicates that the temporal attention mechanism is efficient in the capture of sustained and recurrent attack dynamics significant risks. The tradeoff between balanced accuracy and recall among rare classes indicates that the hierarchical separation of features reduces the effects of class imbalances with no regard to aggressive oversampling or heuristic tuning.

Download:

• PNG
  larger image
• TIFF
  original image

Table 4. Per-Class Detection Performance on CICIDS2017.

https://doi.org/10.1371/journal.pone.0346677.t004

Download:

• PNG
  larger image
• TIFF
  original image

Table 5. Per-Class Detection Performance on TON_IoT Dataset^1.

https://doi.org/10.1371/journal.pone.0346677.t005

The same tendency is noticed on the TON_IoT dataset as MedDefender-MHAN recognizes IoT-related threats systematically such as ransomware, backdoor, and injection attacks. High results of volumetric (DoS/DDoS) and low-rate persistent attacks (backdoor, MITM) describe the possibility of the model to address the heterogeneous attacks semantics. Notably, the false positive rate of normal traffic is low, which means the decision boundaries are stable, and the chances of alerts occurring in a normal healthcare IoT application are minimal.

To extend the evaluation toward advanced and clinically relevant threat scenarios, MedDefender-MHAN is additionally assessed on three high-impact attack categories: Man-in-the-Middle (MitM) attacks, Data Exfiltration attacks, and Advanced Persistent Threat (APT) stages. MitM attacks, already represented in TON_IoT, are detected with a precision of 96.78% and recall of 97.34%, as the model’s temporal attention captures the anomalous bidirectional session hijacking patterns characteristic of these attacks. Data Exfiltration attacks are identified through the model’s sensitivity to sustained encrypted outbound traffic flows, which are semantically aligned with the ransomware and backdoor attention patterns described in Table 7. APT-stage detection — encompassing reconnaissance, lateral movement, privilege escalation, and exfiltration phases — represents a critical future evaluation direction. APT-specific datasets such as DAPT2020 and SCVIC-APT-2021 will be incorporated in subsequent work to validate MedDefender-MHAN against multi-stage, low-and-slow intrusion campaigns that are particularly dangerous in regulated healthcare IoT environments.

Download:

• PNG
  larger image
• TIFF
  original image

Table 7. Interpretation of Attention-Based Explanations in Health care IoT Traffic.

https://doi.org/10.1371/journal.pone.0346677.t007

4.4. Confusion matrix analysis

The confusion matrices in Fig 5 show comprehensive visualization of classification results, which shows that there is a very little confusion between categories of attacks and normal traffic.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 5. Normalized confusion matrices of MedDefender-MHAN on (a) CICIDS2017, and (b) TON_IoT datasets.

The diagonal dominance exhibits good classification behavior of low inter-class confusion.

https://doi.org/10.1371/journal.pone.0346677.g005

4.5. ROC curve analysis

Fig 6 shows Receiver Operating Characteristic (ROC) curves of multi-class classification and indicates that the model has an excellent discrimination ability in all categories of attacks with Area Under Curve (AUC) larger than 0.99 of most of the classes.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 6. ROC curves of MedDefender-MHAN indicating the trade-off of the true positive rate and false positive rate with respect to the various attack category.

The model attains AUC of more than 0.99 on all of the major attack types on both datasets.

https://doi.org/10.1371/journal.pone.0346677.g006

4.6. Explainability evaluation

One of the contributions made by MedDefender-MHAN is that it can produce explainable security decisions. The explainability evaluation methodology employs three complementary and independently verifiable assessments. First, feature alignment (Equation 50) is computed as the intersection-over-expert ratio between the top-K features ranked by MedDefender-MHAN’s aggregated attention importance scores (Equation 29) and the top-K features independently identified by domain experts, with K = 5. Expert annotations were collected from three certified network security analysts, each with a minimum of five years of operational experience in healthcare network security. Analysts independently labeled the defining network flow features for each attack category based on published MITRE ATT&CK for ICS threat intelligence profiles and NIST cybersecurity guidelines. Inter-annotator agreement was quantified using Fleiss’ Kappa (κ = 0.83), indicating strong consensus and validating the reliability of the expert ground truth. Second, temporal accuracy measures the percentage of attack-relevant time windows correctly localized by MedDefender-MHAN’s gradient-weighted attention maps (Equation 31), validated against ground-truth attack onset and offset timestamps embedded in the CICIDS2017 and TON_IoT dataset labels. A localization is considered correct when the peak attention window overlaps with the ground-truth attack window by more than 50%. Third, a direct quantitative comparison is performed between MedDefender-MHAN’s intrinsic attention-based explanations and two post-hoc attribution methods — SHAP [14] and Integrated Gradients [15] — applied to the same classification layer output, using identical K = 5 top-feature and temporal window evaluation criteria to ensure fair comparison. The Fleiss’ Kappa score of κ = 0.83 was computed using the standard multi-rater reliability formula across the three annotators and all 14 CICIDS2017 attack categories (9 for TON_IoT). Each annotator independently ranked the top-5 most discriminative network flow features for each attack category, yielding a 3 × 14 annotation matrix per dataset. Kappa was then computed pairwise across annotator pairs and averaged using the Fleiss extension for multiple raters. The resulting κ = 0.83 falls in the ‘strong agreement’ range (κ > 0.80), validating the expert ground truth used as the denominator in the feature alignment score (Equation 50). For temporal overlap evaluation, each annotator independently marked ground-truth attack onset and offset timestamps per traffic sample. A detection was counted as temporally accurate when the model-predicted peak attention window overlapped the ground-truth window by ≥50% intersection-over-union (IoU). This threshold is consistent with temporal localization standards in time-series anomaly detection literature. Table 6 provides the result of the explainability evaluation between model-identified and expert-formulated attack signature.

Download:

• PNG
  larger image
• TIFF
  original image

Table 6. Explainability Evaluation: Feature Alignment with Expert Annotations.

https://doi.org/10.1371/journal.pone.0346677.t006

Table 7 correlates the attention-based explanations created by MedDefender-MHAN with meaningful healthcare IoT traffic behaviors. The emphasis on DoS and DDoS attacks is associated with temporary bursts of packets that affect the availability of patient monitoring facilities, whereas the emphasis of backdoor attacks is associated with unauthorized access to the device on a long-term basis. The features of port scanning and brute-force attacks are in the form of sequential probing of services and repeated authentication failures.

Attention-Based Explanation Interpretation of Healthcare IoT Traffic respectively, which are prevalent antecedents of clinical network compromise. The explanations related to Ransomware indicate the presence of long encrypted traffic, which is linked to activities of data exfiltration and encryption. These mappings prove that MedDefender-MHAN explanations do not only make quantitative sense but can be also operationally interpreted in the real-world environment of health care IoT.

The attention-related explanations produced by MedDefender-MHAN can undergo interpretable health outcomes representing meaningful healthcare IoT traffic patterns directly. In the case of high-volume attacks like DoS and DDoS, the model will always give high attention to short temporal windows that experience bursts of packets indicating an attempt to disrupt services against patient monitoring systems.

Conversely, the associated backdoor attacks relate to long term focus within long term connections which denote long term unauthorized device access. The offensive behavior of brutality and port scanning attacks contain focused attention among recurrent authentication failures and sequential probing of the service, which is congruent with the reconnaissance and access compromise tactics in clinical networks. This interpretation on the behavior level shows that the MedDefender-MHAN explanations do not merely coincide with expert annotations by chance but are also meaningful to healthcare security analysts.

Fig 7 presents attention heatmap visualizations for six attack categories, where brighter regions indicate higher temporal attention weights. For DoS/DDoS attacks, attention concentrates within short burst windows (time steps 8–15), corresponding to packet flooding activity. Backdoor attacks exhibit sustained attention spread across the entire temporal window, consistent with long-lived covert connections. Fig 8 provides a direct qualitative comparison of explanation outputs from SHAP, Integrated Gradients, and MedDefender-MHAN for a representative DoS instance, demonstrating that the attention-based approach produces temporally-structured, actionable explanations rather than static per-feature attribution scores.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 7. Analyze MedDefender-MHAN in the case of various attack types.

The heatmaps are the attention weights of temporal windows and feature dimension, which are brighter in the areas that have higher attention. Burst patterns of DoS attacks and sustained connection of backdoor attacks have been recognized in the model.

https://doi.org/10.1371/journal.pone.0346677.g007

Download:

• PNG
  larger image
• TIFF
  original image

Fig 8. Comparison of the output of explanation of a representative DoS attack with SHAP, Integrated Gradients and MedDefender-MHAN.

SHAP and Integrated Gradients give a fixed set of feature-wise explanations, whereas MedDefender-MHAN generates a time-varying attention map showing how an attack has evolved with time.

https://doi.org/10.1371/journal.pone.0346677.g008

To make the feature-attention link explicit: for DoS/DDoS attacks, the top-5 attention-weighted features during time steps 8–15 are (1) Flow Bytes/s, (2) Flow Packets/s, (3) Fwd Packets/s, (4) Bwd Packet Length Mean, and (5) Init_Win_bytes_forward — consistent with volumetric flooding signatures identified by expert annotators (alignment score: 96.7%). For Backdoor attacks, where attention spans the entire temporal window, the top-5 features are (1) Flow Duration, (2) Bwd IAT Mean, (3) Active Mean, (4) Idle Mean, and (5) Bwd Packets/s — characterizing long-lived, low-rate covert connections (alignment score: 91.8%). For Port Scan events, attention peaks at time steps 20–30 with dominant features (1) Destination Port, (2) Fwd Packet Length Min, (3) SYN Flag Count, (4) RST Flag Count, and (5) Flow IAT Min, matching sequential port-probing behavior (alignment score: 95.3%). These feature-attention mappings confirm that MedDefender-MHAN’s attention weights are functionally aligned with domain-expert annotations, not merely correlated.

4.7. Comparison with external explainability methods

Although the attention-based explanations produced by MedDefender-MHAN are inherently interpretable, this paper also analyzes the reliability of the explanations by comparing them to the well-known post-hoc explainable AI methods. Specifically, the use of SHapley Additive exPlanations (SHAP) and Integrated Gradients (IG) are used as an example of a model-agnostic and gradient-based attribution method, respectively. The two methods are used on the last layer of classification of MedDefender-MHAN to make the comparison to be fair and consistent without changing the detection architecture.

SHAP explanations are calculated by approximating the scores of feature contribution through a background distribution based on the benign traffic samples, whereas the Integrated Gradients quantify the feature importance by calculating the gradient along a linear path between a baseline input and the observed traffic instance. The ranked features considered in SHAP and IG models are contrasted with those that are pointed out by the internal multi-head attention mechanism of MedDefender-MHAN per each detected attack sample.

Table 8 gives a quantitative performance of explainability of the three methods. Feature alignment is computed as the ratio of shared features between the model’s top-K ranked features and the expert-annotated top-K features for each attack class, using Equation 50, whereas temporal consistency is the capability of the individual mechanism to localize attack-relevant time windows accurately. These findings show that MedDefender-MHAN gives a stronger alignment, and higher temporal consistency than SHAP and Integrated Gradients, reflecting the benefit of using task-specific attention mechanisms instead of post-hoc attribution mechanisms that are not mindful of time.

Download:

• PNG
  larger image
• TIFF
  original image

Table 8. Comparison of Explainability Performance Between MedDefender-MHAN and External XAI Methods.

https://doi.org/10.1371/journal.pone.0346677.t008

Besides the comparison of individual explanation techniques, MedDefender-MHAN is also tested with comparison to the existent XAI-enabled intrusion detection systems. Table 9 demonstrates that MedDefender-MHAN performs better than the baseline XAI-IDS models in features and in time consistency. Although previously existing methods use either the post-hoc or hybrid explainability methods, MedDefender-MHAN is advantaged by intrinsic attention-based explanations that are directly linked with the act of detection. Such architectural integration leads to better temporarily consistent and operationally significant explanations of healthcare IoT traffic.

Download:

• PNG
  larger image
• TIFF
  original image

Table 9. Explainability Comparison with XAI-Enabled IDS Baselines.

https://doi.org/10.1371/journal.pone.0346677.t009

An example of representative explanations of a DoS attack is shown in Fig 8. Although SHAP and IG effectively estimate many high-impact features of the traffic, their explanations are rather inertial and feature-oriented. MedDefender-MHAN, in turn, generates elucidations that are structured in time, with bursting-level traffic characteristics and enduring maliciousness, which is significant to comprehend a healthcare IoT attack in practice. This comparison shows that attention-based explanations incorporated in the detection model offer more consistent and operationally significant information to the security analyst than external post-hoc approaches.

4.8. Comparative analysis

For consistency, all baseline models referenced in Tables 10–15 retain their original naming conventions as reported in the cited works, with citation indices appended for traceability. We make a comparison of MedDefender-MHAN with 12 most advanced intrusion detection approaches. Table 10 shows detailed outcomes on CICIDS2017 dataset.

Download:

• PNG
  larger image
• TIFF
  original image

Table 10. Comparative Performance Analysis on CICIDS2017 Dataset.

https://doi.org/10.1371/journal.pone.0346677.t010

Download:

• PNG
  larger image
• TIFF
  original image

Table 11. Comparative Performance Analysis on TON_IoT Dataset.

https://doi.org/10.1371/journal.pone.0346677.t011

Download:

• PNG
  larger image
• TIFF
  original image

Table 12. Runtime Efficiency Comparison Across IDS Models.

https://doi.org/10.1371/journal.pone.0346677.t012

Download:

• PNG
  larger image
• TIFF
  original image

Table 13. Multi-Dimensional Comparison of IDS Models.

https://doi.org/10.1371/journal.pone.0346677.t013

Download:

• PNG
  larger image
• TIFF
  original image

Table 14. Qualitative Comparison of MedDefender-MHAN with State-of-the-Art IDS Approaches.

https://doi.org/10.1371/journal.pone.0346677.t014

Download:

• PNG
  larger image
• TIFF
  original image

Table 15. Ablation Study Results on CICIDS2017.

https://doi.org/10.1371/journal.pone.0346677.t015

The respective comparisons on the TON_IoT data, which is specifically created to evaluate the security of the IoT, are provided in Table 11.

The chosen baseline approaches are the most recent and applicable intrusion detection techniques in the classical machine learning, deep learning, attention-based, transformer-based and explainable IDS paradigms. Specifically, there are attention-based and transformer-based models that include Self-Attention CNN, SACNN-IDS, Transformer IDS, Attention-RNN, and Multi-Head Transformer to represent the latest state of the art in sequential and dependency-sensitive traffic modeling. Explainable IDS baselines (E-XAI IDS and XAI-IDS) are added to make a reasonable comparison with the post-hoc explainability methods. Techniques that only utilize superficial feature engineering or obsolete signature-based mechanisms are left out by design, since they do not represent the operation and threat characteristics of current healthcare IoT contexts. Such a selection strategy will make sure that the performance benefits of MedDefender-MHAN are compared with the competitive, modern and technically similar models.

Table 12 compares MedDefender-MHAN with some typical basic models in terms of its runtime performance. Lightweight CNN-based models have high through put, but they do not have sophisticated temporal modeling and explainability. The complex attention and post-hoc explanation pipelines result in transformer-based and XAI-enabled IDS models that have significantly high inference latency and low throughput. The tradeoff of MedDefender-MHAN has been to the advantage, with inference latency and throughput being low, and inherent explainability being provided by the system, rendering it applicable to real-time healthcare IoT systems.

Table 13 gives a comprehensive comparison between accuracy, computational efficiency, scalability, and explainability aspects. Although transformer-based and attention-driven models of IDS can deliver a high level of detection, they also tend to have high computational costs or low explainability. IDS techniques based on post-hoc XAI are better at interpretability, at the expense of inference efficiency and scalability. MedDefender-MHAN is the only one to offer a balance between all four dimensions; it can be highly detected and its inference has low latency, its architecture can be scaled, and its explainable characteristics are inherent, and it is especially applicable to large-scale healthcare IoT applications.

4.9. Ablation study

To prove the contribution of every architectural component, we make extensive ablation experiments. Table 15 shows the results of various module configurations.

Table 15, which is the result of the ablation, emphasizes the role of the separate element of architecture and the important design decisions. It is seen that models that are based on CNN or Transformer alone have lower detection accuracy and lack interpretability, which confirms the need to use hierarchical spatial-temporal feature learning. When the multi-head attention (MHA) module is removed, there is a significant decrease in the explainability alignment, which proves that the process of attention is central to the interpretation of the meaningful explanation.

As far as the attention head configuration is concerned, an average number of heads offers the most appropriate trade-off between performance and efficiency. Though the more the attention heads the more the alignment of the features and the better the rate of detecting the features, the more the addition of the attention heads means more computational overhead and the least improvement of the accuracy. Say, as much as the 16-head design gives a slightly better alignment, it has higher latency, and therefore, it is not as convenient to use in real-time healthcare IoT implementation. The last MedDefender-MHAN configuration thus uses a balanced attention parameter that maximizes detection and explainability and minimizes inference latency, which depicts diminishing returns to the size of attention configurations.

4.10. Computational efficiency

Fig 9 shows the analysis of the computational efficiency between inference latency and throughput of the various methods.

Download:

• PNG
  larger image
• TIFF
  original image

Fig 9. Comparison of computational efficiency providing (a) inference latency in samples and (b) throughput in samples per second.

MedDefender-MHAN is optimal in terms of its ability to detect and compute efficiency.

https://doi.org/10.1371/journal.pone.0346677.g009

Table 16 represents a summary of the computational performance of MedDefender-MHAN when compared to typical baseline models. Although lightweight CNN-based methods are less latent, they have lower detection accuracy and interpretability. The IDS models based on transformers have much greater computational overhead with the full self-attention operations leading to longer inference latency and higher memory consumption. Conversely, MedDefender-MHAN has a balanced computational profile through the use of hierarchical feature extraction and selective multi-head attention with sub-3ms inference latency and moderate FLOPs and memory requirements. This compromise renders the suggested model applicable to implementation in resource-limited healthcare IoT settings such as edge and fog computing systems.

Download:

• PNG
  larger image
• TIFF
  original image

Table 16. Computational Efficiency Comparison Across Models.

https://doi.org/10.1371/journal.pone.0346677.t016

5.1. Performance analysis

MedDefender-MHAN has demonstrated superior detection performance over existing methods with accuracy of 99.47 percent on CICIDS2017 and 98.92 percent on TON_IoT. The statistically significant difference between the results of the observed improvement over the strongest competing baseline, the Multi-Head Transformer [8], is scaled t-test (p < 0.01). The findings suggest that proposed architecture can always learn discriminative attack features in both the general-purpose and IoT-oriented traffic setting.

In the quest to prove robustness further, paired statistical significance tests were done on accuracy and F1-score between repeated experimental runs. The findings affirm that MedDefender-MHAN is much better in both datasets than the most robust attention-based baseline, and p < 0.01 is achieved in all the measures considered. Such statistical data shows that the improvements in performance are systematic and can be reproduced, but not a result of random initialization, data partitioning, or bias on the dataset at hand.

In addition to the numerical benefits, the excellence of MedDefender-MHAN is based on the ideas of principled architectural differentiation instead of the tuning of the parameters. Contrary to traditional transformer-based intrusion detection models that use only one attention encoder to learn the heterogeneous traffic behavior, MedDefender-MHAN separates the learning of representations into the complementary spatial and temporal pathways. The model, due to this hierarchical separation, is able to independently represent such short-lived burst activities and longer lasting malicious patterns of communication and minimizes feature interference and enhances selectivity of attention. These design options directly lead to a better detection of high-volume attacks like DoS and DDoS where temporal structure is a key factor.

Per-class analysis also indicates that MedDefender-MHAN is able to show a high and steady detection performance among various types of attacks. The effectiveness of temporal modeling is manifested in high-volume attacks that have near-perfect recall and precision. In rare and low-frequency attacks like Infiltration and Heartbleed, a slight decrease in performance is observed as a result of a small sample size, which is also a familiar issue in intrusion detection. Notably, the recall is good in such classes, which is essential in medical scenarios where failures to detect early can be disastrous. These restrictions imply that in the future, it is possible to expand the data and or do few-shot learning without compromising the existing model.

In terms of the learning dynamics, three architectural properties are used to understand the sustained advantage of the model. First, hierarchical feature decomposition ensures that prominent traffic patterns do not mask more subtle signs of attack, which is a typical feature of monolithic attention-based models that are heterogeneous behaviors competing in the same representation space. Second, multi-head attention on features encoded temporally facilitates specialization in attention, with each head learning different attack semantics (e.g., burst intensity, persistence, protocol deviation etc.). This variety is robust in response to variability of attacks and noise sensitivity, especially in mixed-traffic healthcare IoT scenarios.

Third, the close interrelation of attention representations and explainability generation has an implicit regularization effect. Due to the fact that the same attention mechanism is provided to support classification and explanation, the model is not encouraged to use spurious correlations that cannot be uniformly decoded. This model-level limitation enhances cross-dataset and cross-attack-distribution generalization, the fact of which is why MedDefender-MHAN can outperform CICIDS2017 and TON_IoT without overly complex models or heuristic hyperparameter exploration. Generally, the performance benefits can be attributed to the consistent architectural design decisions, which collectively maximize accuracy, interpretability, and deployability in healthcare internet of things systems.

5.2. Explainability quality

The 94.6% correlation of model-identified features with expert annotations is a confirmation of the clinical usefulness of explanations provided by MedDefender-MHAN. The level of importance of the features of the models can be assured by security analysts to interpret detection decisions and focus on investigation activities. The capability of identifying timelines of attacks is also very useful in healthcare settings, where knowing when an attack has taken place is vital to its response.

When comparing and contrasting and post-hoc explainability methods methods (E-XAI [15], XAI-IDS [19]) it can be seen that the attention-based explanations inherent in MedDefender-MHAN offer more consistent and efficient computational explanations. Post-hoc techniques will need extra processing time (6–8ms overhead), however MedDefender-MHAN provides explanations as a byproduct of inference with very little added cost.

5.3. Computational considerations

The 2.3ms inference time makes MedDefender-MHAN the right choice to be deployed in healthcare networks in real-time. The model can accommodate traffic across several medical devices at a time with a throughput of more than 400 samples per second per single graphic card. Its small size (9.36MB) allows it to operate on the edge computing platforms which are typically deployed as part of the healthcare IoT infrastructure.

The ablation study has validated that every architectural element plays an important role in performance. The removal of the multi-head attention mechanism leads to a decrease in accuracy by 0.8 percent, and the removal of the dual-stream feature extraction leads to a reduction in the performance by almost 2 percent. The 8-head specification constitutes a perfect trade-off in the model capacity and computation efficiency.

5.4. Healthcare-specific implications

The findings indicate that MedDefender-MHAN can be implemented in the regulated healthcare setting. High detection rates, low inference latency rates, and transparent decision-making are key attributes of the technology that directly cover the important needs that are stipulated by healthcare regulation bodies. Specifically, the U.S. Food and Drug Administration (FDA) instructions on AI-based medical device suggest the necessity of explainable and auditable algorithms, and MedDefender-MHAN explainable attention-based mechanism supports this point.

In terms of robustness and generalization, the research using two different datasets only enhances the demonstration of the applicability of the proposed method. CICIDS2017 is a general-purpose network intrusion dataset that has a large variety of traditional attack patterns, whereas TON_IoT reflects heterogeneous IoT-specific traffic features that are more typical of real-world connected networks. The excellent MedDefender-MHAN results on the two data sets suggest that the model is not overfitted to a single traffic environment but rather learns transferable representations that can generalize across general network and IoT-based threat environments.

The cross-dataset validation is especially critical in the healthcare IoT applications, where the network traffic tends to have hybrid nature, both of the conventional IT infrastructure and the specialized medical equipment. Its properties of being able to retain peak detection rates and dependable elucidation within these heterogeneous environments mitigate the integration of the model into clinical security procedures. By using the explanations that are generated, healthcare security teams can use the explanations to validate alerts, minimize false positives, and enhance the efficiency of incident responses without adversely affecting patient safety or the regulatory compliance.

MedDefender-MHAN is well suited to hierarchical healthcare security architectures that include edge and fog and cloud layers of healthcare security deployment. The sub-3ms inference latency and relative computational footprint of the model at the edge level allows it to be deployed on IoMT gateways and controllers located near medical devices to conduct real-time screening of threats. On the fog level, full MedDefender-MHAN instances can be hosted on the hospital server and consolidate traffic across different departments, apply explainability-driven alert triage, and facilitate quick incident response. The model can be incorporated at the cloud or central security operations center (SOC) to provide the ability to correlate threats on a large scale, long-term analytics, and regulatory auditing. This elastic deployment capability enables the healthcare providers to achieve trade-offs between the latency, resource supply, and privacy limitations and provide a uniform detection and explainability throughout the healthcare infrastructure.

5.5. Clinical deployment, privacy, and regulatory compliance

The implementation of intrusion detection systems in healthcare facilities is highly restricted in terms of clinical, privacy, and regulatory controls that transcend the traditional network security factors. Medical IoT infrastructures work with very delicate patient information and in many cases, provide life-threatening processes, demanding not merely precise but also open, dependable and regulatively suitable security mechanisms.

Regulatively speaking, MedDefender-MHAN is in compliance with the major principles of healthcare AI governance models. Concerning AI systems that can potentially have an impact on clinical processes, the U.S. Food and Drug Administration (FDA) guideline on software as a medical device highlights the significance of the transparency of algorithms, auditability, and risk management in AI systems. MedDefender-MHAN provides traceability and regulatory audit requirements by allowing security decisions based on intrinsic explanations, based on attention, and allows documentation of the explanations, which are validated and inspected to obtain the required results. In the same way, the General Data Protection Regulation (GDPR) requires any automated decision-making system that involves individuals to provide meaningful information as to the logic behind it. This requirement is directly facilitated through the explainability mechanism of the model which points out the characteristics of the traffic and the time dynamics that accounts to each detection outcome.

Another essential issue in the IoT implementation of healthcare is privacy preservation. MedDefender-MHAN works without looking at any data in the payloads and only on metadata and patterns of traffic behaviour at the network level, minimising the risk of exposing personal identifiable information or sensitive medical records. This design addresses privacy-by-design principles, which are gaining more and more significance in regulated healthcare systems, and reduces the amount of data processing.

False positive is also a very serious issue in a clinical setting where unnecessary notifications may discourage workflows, flooding security personnel, and may even disrupt patient care. The explanations generated by MedDefender-MHAN of interest and guided by attention enable security analysts to quickly confirm detections, separate anomalies that are not harmful and those that are actually dangerous, and silence false alarms. This ability will decrease alert fatigue and decrease the chances of unneeded intervention on medical equipment or clinical networks.

Regarding the viability of deployment, the model has a low inference latency and medium inversion footprint, which allows the integration to be flexible to edge, fog, and cloud-based healthcare architectures. Lightweight edge deployments have the potential to offer quick preliminary threat screening near medical devices and centralized hospital security systems have the opportunity to take advantage of the results of full explainability to conduct forensic analysis and report compliance. In general, MedDefender-MHAN is capable of providing an adequate balance between security effectiveness, regulatory compliance, and patient safety, which is why it can be used in the real-life healthcare IoT setting.

In addition to regulatory and technical factors, the use of AI to make security-related decisions in healthcare systems brings ethical threats that should be clearly resolved to achieve safe and responsible implementation. The possibility of overblocking or unwarranted isolation of medical equipment because of false positive detection is one major concern. Within a clinical setting, the disruption of network connectivity, which can be automated, could cause a delay in diagnostics, disrupt therapy administration, or impact patient monitoring. MedDefender-MHAN avoids this threat by offering interpretable attention-based explanations, which enable security operators to validate detections prior to enforcement actions being taken, which justifies informed decision-making instead of fully autonomous intervention.

The other ethical issue is connected with the possible bias in the attack labeling and model training information. Intrusion datasets might be undersized to represent some types of devices, clinical workflows or low-frequency attack patterns, resulting in biased detection behavior which is disproportionately represented to certain medical systems. To minimize this pitfall, MedDefender-MHAN will be configured to base its decisions on behavioral level traffic, as opposed to device identifiers, enhancing the equity of cross-heterogeneous healthcare IoT infrastructures. Also, the explainability mechanism allows the practitioners to find cases of systematic misclassification and modify the policies or retraining strategies.

A highly important mitigation measure in the deployment of ethics in healthcare facilities is human-in-the-loop oversight. Instead of substituting clinical or security judgment, MedDefender-MHAN is a decision-support system that supplements the expertise of the human. The security analysts still have control over the response measures, as model explanations are employed to put the alerts into perspective and consider cybersecurity enforcement and patient safety concerns. This anthropocentric design methodology can be implemented in accordance with the new ethical AI principles and can be used to make sure that the automated security decisions are responsible, transparent, and aligned with clinical priorities [39].

5.6. Limitations and future directions

In spite of good outcomes, there are other limitations that should be considered. To begin with, benchmark datasets were evaluated, which are extensive, but might not be as representative of the diversity of healthcare IoT traffic as possible. The practical implementation would be enhanced by the validation on medical-specific datasets including the traffic of real medical equipment.

Second, the existing explainability framework is oriented on feature and temporal significance which healthcare stakeholders can need other modalities of explainability, e.g., counterfactual reasoning or natural language explanations. Further enhancements to the explainability module (initially to deliver multi-modal explanations depending on user roles (clinicians, security analysts, administrators) would be possible in the future.

Third, the model is based on a predetermined window length of time, which might not be the best in all types of attacks. The temporal signature of many attacks may be better detected due to an adaptive sizing of the window, based upon the traffic characteristics.

Nomenclature

Download:

• PNG
  larger image
• TIFF
  original image

https://doi.org/10.1371/journal.pone.0346677.t017