Dual-layer edge intelligence for secure real-time medical IoT: a Zero-Trust sequential framework integrating soft-voting intrusion detection and Histogram Gradient Boosting

Introduction The Internet of Medical Things (MIoT) enables continuous transmission of patient vital signs for real-time monitoring and clinical decision making in intensive care units. A lot of different and interdependent devices are used in these medical settings in order to ensure time and reliability for healthcare services. But with 24/7 connectivity comes the danger of cyberattacks, unauthorized access and tampered medical information. Cloud-based processing also causes delays in communication and reliance on network availability and could impact the timely delivery of critical clinical alerts. The current studies are mostly related to patient monitoring, or network intrusion detection, and only a few merge both these functions within a single edge computing setup. Methods This article proposes a Dual-Layer Edge Intelligence Framework for secure real-time Medical IoT. The framework executes two Artificial Intelligence modules sequentially on a ward-level edge node. A Security AI Module, built on a soft-voting ensemble, screens every network flow first and acts as a Zero-Trust gate. Only traffic that it clears as benign is passed to the Healthcare AI Module, built on Histogram Gradient Boosting, which screens the patient's physiological state for anomaly-based indicators of critical deterioration. This sequential design makes sure that none of the clinical decisions are taken based on unverified information, while at the same time making sure there is safe interaction between network management and healthcare analytics. The framework was tested with two benchmark datasets, which are CICIDS-2017 and MIMIC-IV. Results : The Security AI Module has an accuracy of 99.4% with a false positive rate of less than 2% and the Healthcare AI Module has a cross-validated accuracy of 98.97% and ROC-AUC of 0.995 with complete recall on all the validation folds. The complete sequential pipeline achieved an end-to-end latency of approximately 28.8 ms, making it suitable for real-time intensive care monitoring. Discussion A permissioned Hyperledger Fabric ledger with IPFS off-chain storage is presented as a conceptual future governance layer; it is not implemented or evaluated in this study. The findings show that adopting Zero-Trust security and clinical intelligence in one edge framework offers a viable paradigm for secure, low-latency, and trustworthy Medical IoT systems.