An Explainable Machine Learning Framework for Multi-Class Cyberattack Detection in IoMT Networks Using the MedSec-25 Dataset

As Internet of Medical Things (IoMT) technologies become increasingly integrated into healthcare infrastructures, the attack surface of medical networks expands due to continuous communication among medical devices, patient monitoring systems, and hospital information infrastructures. Therefore, intrusion detection systems for IoMT environments should provide not only high classification performance but also interpretability, robustness, and computational feasibility. This study proposes an explainable machine learning framework for multi-class cyberattack detection in IoMT networks using the MedSec-25 IoMT Cybersecurity Dataset. The dataset consists of 554,534 flow records with 84 attributes and five classes: Benign, Exfiltration, Initial access, Lateral movement, and Reconnaissance. During preprocessing, identity-based and non-generalizable variables were removed, and only numerical flow-based features were used. Feature selection was performed using correlation-based reduction, Mutual Information, and Random Forest importance. The experimental design was extended by evaluating Decision Tree, Random Forest, XGBoost, LightGBM, Linear SVM, and Multi-Layer Perceptron models. In addition to the stratified 80/20 holdout test, stratified 5-fold cross-validation was applied to assess robustness. The best performance was obtained by the Random Forest model trained with the top 20 features selected by Mutual Information, achieving 99.06% accuracy, 95.89% macro precision, 96.26% macro recall, and 96.07% macro F1-score on the holdout test. In 5-fold cross-validation, the same model achieved 99.04% ± 0.04% accuracy and 96.03% ± 0.15% macro F1-score, indicating stable performance across folds. Class imbalance handling experiments showed that class-weighted Random Forest provided the best overall balance compared with no balancing, controlled SMOTE, and random undersampling. Port ablation analysis demonstrated that port-related variables were highly discriminative; however, the model still achieved strong performance using non-port numerical features, suggesting that it did not rely exclusively on port-specific traces. Global and local SHAP analyses revealed that port information, flow duration, packet density, and inter-packet timing statistics were the most influential factors in model decisions. The findings suggest that, under the evaluated MedSec-25 experimental setting, the proposed framework provides accurate, interpretable, and computationally efficient multi-stage attack detection for IoMT network traffic.