# A Novel Internet of Medical Things Hybrid Model for Cybersecurity Anomaly Detection

## TL;DR

This paper introduces a new cybersecurity model for IoMT devices that combines GCN and transformer architectures to detect anomalies and protect patient data.

## Contribution

A novel hybrid model combining GCN and transformers for IoMT cybersecurity anomaly detection is proposed and evaluated.

## Key findings

- The hybrid model outperforms traditional ML baselines in detecting IoMT anomalies.
- The model provides early detection capabilities for cyberattacks on IoMT devices.
- The CICIOMT24 dataset is introduced to emulate real-world IoMT network traffic and attacks.

## Abstract

The proliferation of Internet of Medical Things (IoMT) devices connected to the internet poses significant challenges to data integrity, confidentiality, and patient safety due to their vulnerability to outside exploitation. Specifically, IoMT devices capture and process vast amounts of sensitive patient data but often lack adequate security mechanisms, making them susceptible to attacks that compromise data integrity—such as the injection of false or fabricated information—which imposes significant risks on the patient. To address this, we introduce a novel hybrid anomaly detection model combining a Graph Convolutional Network (GCN) with a transformer architecture. The GCN captures the structural relationships within the IoMT data, while the transformer models the sequential dependencies in the anomalies. We evaluate our approach using the novel CICIOMT24 dataset, the first of its kind to emulate real-world IoMT network traffic from over 40 devices and 18 distinct cyberattacks. Compared against several machine learning baselines (including Logistic Regress, Random Forest, and Adaptive Boosting), the hybrid model effectively captures attacks and provides early detection capabilities. This work demonstrates a scalable and robust solution to enhance the safety and security of both IoMT devices and critical patient data.