IoHT attack detection using transformer-aware feature selection with CNN-BiLSTM optimized by hybrid WOA–GWO

The rapid proliferation of Internet of Health Things (IoHT) devices has dramatically enlarged the attack surface of healthcare networks, where intrusion detection is challenged by high-dimensional, redundant features, evolving attack behaviors, and strict real-time constraints at edge or near-patient devices. This study aims to design a leakage-safe, latency-aware intrusion detection pipeline that simultaneously improves detection accuracy, robustness, and deployability in realistic IoHT environments. We propose a unified framework that combines a novel Transformer-Aware Wrapper Feature Selection (TAW-FS), a compact CNN–BiLSTM classifier, and a hybrid Whale–Grey Wolf Optimization (WOA–GWO) tuner: TAW-FS leverages transformer attention to rank features and iteratively retain a compact subset from the original 50 attributes, CNN–BiLSTM jointly captures local flow motifs and short-range temporal dependencies, and the hybrid tuner balances exploration and exploitation under a multi-objective, latency-aware fitness. Experiments on a publicly available IoHT intrusion benchmark comprising 188,694 flows (stratified 80/20 split) are conducted without test-set peeking, with all preprocessing, feature selection, and tuning confined to the training data. On the held-out test set (Attack as positive), the proposed method attains Accuracy 99.12%, Precision 99.14%, Recall 99.12%, F1-score 99.12%, MCC 98.50%, ROC–AUC 0.9916, and median inference latency of 0.88 ms per sample, consistently outperforming strong baselines such as XGBoost, CatBoost, Temporal Convolutional Networks, and TE-1D under identical budgets; improvements are statistically significant under a two-sided Wilcoxon test (α = 0.05). These results demonstrate that the proposed TAW-FS + CNN–BiLSTM + WOA–GWO pipeline offers a novel, practically viable IoHT intrusion detector that is both highly accurate and well suited for real-time deployment in resource-constrained smart-healthcare networks.