Residual temporal CNNs for emerging cyber threat detection in healthcare IoT

Abstract The rapid advancement of Internet of Things (IoT) technologies has accelerated the emergence of healthcare-IoT (H-IoT) systems. These systems rely on wearable devices to monitor patient vitals and enable timely alerts in precision healthcare settings. Despite these benefits, a single H-IoT network topology might be exposed to multiple simultaneous threats, particularly those attacks designed to manipulate medical sensor data at the application layer. This poses significant challenges for real-time detection and classification of diverse attack behaviors. To address this, a realistic application-layer attack model is developed using the Cooja simulator, modeling H-IoT nodes that track body temperature, oxygen level, and heart rate under concurrent Selective Forwarding (SF), Man-in-the-Middle (MITM), and Distributed Denial of Service (DDoS) attacks. Based on this setup, a dataset is generated to train the proposed deep learning model. This research proposes a deep learning model, a Residual-Temporal Convolutional Network (Res-TCN), designed to classify multiclass attacks while maintaining low latency per sample in H-IoT environments. It also uses the Synthetic Minority Oversampling Technique (SMOTE) during training to mitigate class imbalance and reduce overfitting. The proposed model achieves a high classification accuracy of 99.32% and outperforms traditional ML and DL methods. This demonstrates its effectiveness in real-time decision-making for securing H-IoT systems. Based on these findings, the Res-TCN model is potentially well-suited for deployment in resource-constrained H-IoT environments.