A Multi-Modal AI Framework for Intrusion Detection in Healthcare IoT

The rapid adoption of Healthcare Internet of Things (HIoT) technologies has increased the exposure of safety-critical medical infrastructures ‎to sophisticated cyberattacks, while simultaneously imposing strict constraints on availability, privacy, and false alarm tolerance. Traditional ‎network-centric intrusion detection systems (IDSs) struggle to reliably detect stealthy, low-rate attacks in healthcare environments, where ‎encrypted traffic and predictable clinical communication patterns limit observability. This paper proposes a lightweight multi-modal intrusion ‎detection framework for HIoT networks that jointly analyzes network flow metadata and device telemetry using structured feature fusion ‎and ensemble meta-learning. By integrating communication behavior with device-level operational regularity, the framework provides a ‎more comprehensive representation of system activity without relying on payload inspection. An extensive evaluation was conducted using ‎heterogeneous IoT and botnet datasets, including TON_IoT, IoT-23, and MedBIoT, under realistic conditions of class imbalance. Experi-‎mental results demonstrate that the proposed framework achieves 97.1% detection accuracy and 96.5% F1-score, outperforming state-of-‎the-art network-only IDS baselines. Most notably, the framework reduces the false positive rate to 2.4%, representing a relative reduction ‎of over 38% compared to strong deep learning baselines. Attack-wise analysis shows the most significant performance gains for stealthy ‎and low-rate attack classes, where network-centric IDSs exhibit substantial degradation. Ablation studies confirm that device telemetry im-‎proves recall for stealthy threats, while ensemble meta-learning stabilizes predictions and suppresses false alarms. Latency and scalability ‎measurements further indicate that the framework remains suitable for real-time deployment at healthcare gateway nodes. Overall, the results ‎provide strong empirical evidence that multi-modal intrusion detection materially improves detection reliability, clinical safety, and robust-‎ness in healthcare IoT environments, addressing key limitations of existing single-modality IDS approaches.