Zero-Day Exploits in Healthcare IoT Networks

The rapid adoption of Healthcare Internet of Things (HIoT) systems has enhanced patient care. Still, it has also exposed hospitals to sophis-ticated zero-day exploits that can bypass traditional intrusion detection systems. These threats pose a significant risk to patient safety and compromise clinical operations, necessitating detection mechanisms that are both accurate and efficient, and aligned with the specific re-quirements of healthcare. This paper introduces a multi-layer security framework that integrates hybrid anomaly detection, Extreme Value Theory (EVT)-based thresholding, blockchain-assisted forensic logging, and severity-aware mitigation. The detection ensemble combines autoencoder recon-struction, LSTM-based predictive modeling, and statistical distribution monitoring, while EVT establishes statistically principled thresholds to reduce false alarms. Blockchain ensures tamper-proof accountability, and mitigation actions are prioritized based on device criticality and clinical risk. Extensive evaluation using CIC-IDS2017, TON_IoT, and N-BaIoT datasets demonstrates the effectiveness of the framework. The system achieved a detection rate of 96.4%, a false positive rate of 1.1%, and an average latency of 6.8 ms, outperforming baseline solutions includ-ing Snort, Suricata, Kitsune, and LSTM-based IDS. Additional experiments confirmed scalability under large device populations, resilience against adversarial evasion, and negligible blockchain overhead. By combining statistical rigor with clinical feasibility, the proposed framework provides a trustworthy and deployable solution for zero-day exploit defense in HIoT, advancing the development of secure and resilient innovative healthcare ecosystems.