Transformer-Based Multi-Class Intrusion Detection Using CICIoMT2024 Dataset for Secure IoMT Networks

Abstract

Internet of Medical Things (IoMT) ecosystems significantly enhance healthcare services but simultaneously expand the attack surface, exposing medical networks to diverse cyber threats such as distributed denial-of-service and spoofing attacks. Existing intrusion detection systems for IoMT are often limited to binary classification and struggle to capture complex multi-class attack behaviors, particularly under highly imbalanced data distributions. This study proposes a deep Transformer-based intrusion detection model as a reproducible baseline for multi-class intrusion detection in IoMT environments. The model is evaluated on the CICIoMT2024 dataset, which comprises 19 traffic classes including benign and multiple attack categories. Data preprocessing involves stratified data splitting, feature normalization, and label encoding to ensure fair evaluation. The proposed baseline employs a six-layer Transformer encoder with eight attention heads and is trained using the AdamW optimizer. Experimental results demonstrate an overall accuracy of 98.76% and a macro F1-score of 0.92, indicating strong detection capability across most attack classes. The model achieves excellent performance on benign traffic and high-volume attacks such as DDoS and DoS, while performance degradation is observed on minority classes, including ARP spoofing, highlighting the impact of class imbalance. These findings establish the proposed Transformer model as a transparent and robust baseline for IoMT intrusion detection research. By providing reproducible performance benchmarks, this work supports future development of hybrid and imbalance-aware detection mechanisms aimed at enhancing real-time security in medical cyber-physical systems.