CNN-BiLSTM-Based Hybrid Deep Learning for Multi-Metric Anomaly Detection and Mitigation in Secure IoMT Healthcare WBANs

Wireless Body Area Networks (WBANs) have become an essential component of modern Internet of Medical Things (IoMT) healthcare systems, enabling continuous monitoring of patient physiological signals through wearable sensors. Despite their advantages, WBAN environments remain highly prone to cyber threats, privacy breaches, and single points of failure. To address these risks, this work proposes a Hybrid Multi-Metric Anomaly Detection (HM-MAD) framework deployed on the NodeMCU-32S platform with BLE 5.0 connectivity for secure continuous glucose monitoring (CGM) data transmission. The detection model simultaneously analyses physiological signals, system-level parameters, and network-level communication metrics, enabling the reliable identification of multiple cyberattacks. The proposed system focuses on securing data transmission against relay attacks, where attackers induce communication delay without modifying payloads, potentially leading to false glucose readings, improper insulin dosage delivery, unauthorized control or denial-of-service. The Convolutional Neural Network (CNN) and Bi-Directional Long Short Term Memory (BiLSTM) model classifies attack types including timing manipulation, replay attacks, power glitches, firmware tampering, and sensor spoofing. Experimental evaluation demonstrates that the proposed CNN + BiLSTM framework achieves 94.6% detection accuracy with an average inference latency of 15 ms, representing a 50% latency reduction compared to Transformer-based intrusion detection models (30 ms), while simultaneously reducing computational overhead by 28% in terms of floating-point operations and memory utilization. These results indicate that the HM-MAD framework provides an effective and scalable solution for protecting resource-constrained IoMT healthcare systems against emerging cyber threats.