XGB-AGMoE: A Validation-Adaptive XGBoost-Anchored Granular Mixture-of-Experts Framework for Multi-Class Intrusion Detection in IoMT WiFi–MQTT Traffic

The Internet of Medical Things (IoMT) environment is based on WiFi and MQTT communication, which results in highly imbalanced intrusion-detection data with a high degree of heterogeneity. In this study, XGB-AGMoE is proposed, a validation-adaptive XGBoost-anchored Granular Mixture-of-Experts framework that combines the quantile-derived granular descriptors and experts of CatBoost, LightGBM, XGBoost, class-wise post hoc sigmoid calibration, leakage-free logistic-regression stacking, and an XGBoost-anchored probability fusion stage. The official test partition was set aside for final evaluation after disjoint development subsets were used for preprocessing, calibration, stacking, and anchor selection. The value of 0.80 was chosen for the anchor weight for the calibrated XGBoost, and 0.20 was chosen for the calibrated stack for the canonical seed-42 experiment. The resulting model achieved 0.993887 accuracy, 0.993681 weighted-F1, 0.851256 macro-F1, 0.999634 macro-ROC-AUC, and 0.921352 macro-PR-AUC on a 150,000-record official test sample. The Brier score, negative log-likelihood, and expected calibration error were 0.007531, 0.015309, and 0.001775, respectively. Across seeds 42, 52, and 62, accuracy was 0.9926±0.0012 and macro-F1 was 0.8238±0.0251. Recall was higher for the top denial of service classes and lower for DDoS Publish Flood and Recon VulScan. The results corroborate with expert anchoring and validation-controlled evaluation; they also highlight that there are fusion gains that depend on the data split and that they should be evaluated in the light of robust component baselines.