Analysis of ML Models in Detecting and Mitigating Anomalies in Healthcare Networks

Abstract

The increasing integration of digital technologies in healthcare has introduced significant cybersecurity challenges. The sensitivity of patient data, combined with the complexity and interconnectedness of healthcare networks, makes them prime targets for sophisticated cyberattacks. Traditional security mechanisms, including rule-based intrusion detection systems, exhibit notable limitations in detecting evolving and advanced threats. Machine learning and deep learning techniques have emerged as powerful solutions to enhance IDS capabilities, enabling real-time anomaly detection and automated threat mitigation. This study utilizes the CICIoMT2024 and IoMT Traffic data dataset to evaluate the effectiveness of ML-based IDS methodologies specifically within healthcare network environments. Initially, various models such as Random Forest (RF), Extreme Gradient Boosting (XGB), Logistic Regression (LR), and Deep Neural Networks (DNN) were assessed for their efficacy in detecting cyber threats. However, a hybrid CNN-LSTM architecture was ultimately finalized due to its superior performance in handling imbalanced datasets, modeling complex temporal feature interactions, and delivering high detection accuracy with minimal false positives. The research analyzes challenges faced by healthcare-oriented IDSs, including high false positiveness, data imbalance, computational resource constraints, and limitations inherent in available datasets. Future research directions are proposed, emphasizing the integration of federated learnings, optimized feature selection techniques, real-time IDS deployment strategies, and development of privacy-preserving cybersecurity frameworks tailored for healthcare environments.