From Classical to Deep Learning: A Hybrid CNN–Ensemble Framework for Intrusion Detection in Internet of Medical Things

With the rapid expansion of the Internet of Medical Things (IoMT), the risks of cybersecurity have increased exponentially in healthcare settings, exposing patients’ safety. Three fundamental issues that existing intrusion detection systems (IDS) are challenged by are: (1) limited cross-domain generalization, (2) high computation requirements not suitable for edge deployment, and (3) absence of systematic comparison between classical machine learning (ML) and deep learning (DL) approaches on IoMT-specific data. In this paper, we propose a multi-dataset evaluation framework that covers six models (Random Forest, XGBoost, DNN, CNN, LSTM, and CNN-LSTM) across three different datasets: WUSTL-EHMS-2020, Edge-IIoTset, and UNSW-NB15. We show that there is a scale-dependent pattern: classical ensemble methods work best when the data is small (F1 = 0.914 ± 0.013 on WUSTL-EHMS-2020); the proposed hybrid CNN–Ensemble framework performs best when the data is large (F1 = 0.968 ± 0.002 on UNSW-NB15 with 62.8% fewer features). The proposed framework achieves a total model size of 2.11 MB and an inference latency of 111.6 ms, with seven out of the top 15 discriminative features being patient vital signs, giving the first quantitative evidence that physiological data systematically contributes to IoMT attack detection, which is demonstrated through an explainability analysis using the SHAP approach. Cross-dataset generalization experiments across six transfer scenarios expose fundamental limitations in domain transfer, establishing an important baseline for future research.