Unsupervised Anomaly Detection in IoMT Based on Clustering and Online Learning

Anomaly detection in the Internet of Medical Things (IoMT) is important for ensuring the timely identification of potential health issues. To address this challenge, this paper presents a novel approach combining clustering and unsupervised learning with online adaptation. Patient data collected from IoMT sensors, including vital signs and health alerts, is first preprocessed to ensure quality and reliability. We then employ clustering algorithms to identify clusters containing normal data, which are then used to train unsupervised anomaly detection models. The models evaluated include Isolation Forest, One-Class Support Vector Machine (OCSVM), Local Outlier Factor (LOF), and Elliptic Envelope (EE). To maintain the model's effectiveness over time, an online learning mechanism updates the model with new data every 5000 samples. Our experimental results demonstrate that the LOF model provides the best performance with high precision, recall, F1-score, and Area Under the Curve (AUC) while maintaining computational efficiency with varying amounts of training data. For instance, with 30,000 samples, the LOF model achieved an accuracy of 0.867, and an AUC score of 0.964. Despite similar performance metrics, Spectral Clustering was found to be impractical due to its excessive training time. These results highlight the effectiveness and practicality of our approach for real-time anomaly detection in IoMT.