PRIVACY-PRESERVING INTRUSION DETECTION FOR THE INTERNET OF MEDICAL THINGS USING ENSEMBLE AND FEDERATED LEARNING

Abstract

The rapid proliferation of the Internet of Medical Things (IoMT) has transformed healthcare by enabling continuous monitoring, intelligent diagnostics, and data-driven clinical decision-making. However, this increased connectivity has significantly expanded the attack surface of healthcare systems, exposing sensitive patient data and critical medical devices to cyber threats such as intrusion and data exfiltration attacks. Ensuring both strong security and strict privacy preservation in IoMT environments remains a fundamental and unresolved challenge. This dissertation investigates the design and evaluation of robust and privacypreserving intrusion detection systems (IDS) for IoMT networks using advanced machine learning techniques. The research first examines the effectiveness of ensemble learning–based IDS models in centralized settings, evaluating Stacking, Bagging, and Boosting approaches with Random Forest and Support Vector Machine base learners on the WUSTL-EHMS-2020 dataset. Experimental results demonstrate that ensemble learning significantly enhances detection performance, with the Stacking model achieving an accuracy of 98.88%, followed by Bagging at 97.83%, while Boosting exhibits comparatively lower performance. Building on these findings, the dissertation extends intrusion detection to decentralized and privacy-sensitive IoMT environments through a federated learning (FL) framework integrated with Differential Privacy (DP) and secure aggregation mechanisms. Multiple experimental configurations are systematically analyzed, including raw imbalanced data, centralized SMOTE, and clientside (per-client) SMOTE under varying privacy budgets (ϵ = 3.0, 10.0, and non-private baselines). Results show that privacy-preserving federated models frequently match or exceed non-private baselines. In particular, raw imbalanced and per-client SMOTE configurations achieve high detection accuracy (approximately 94.6%) even under strict privacy constraints (ϵ = 3.0), demonstrating effective learning with minimal utility loss. Furthermore, client-side data balancing consistently outperforms centralized balancing, providing improved training stability while maintaining full data decentralization and patient confidentiality. Overall, this dissertation presents a comprehensive, scalable, and privacy compliant intrusion detection framework for IoMT systems. By integrating ensemble learning, federated learning, class imbalance mitigation, and differential privacy, the proposed approach successfully balances detection accuracy, privacy preservation, and computational efficiency. The findings provide both theoretical insights and practical guidelines for deploying secure and regulation-compliant IDS solutions in real-world healthcare IoMT environments.