A generative adversarial network-augmented dual-stream Mamba-transformer framework for advanced intrusion detection and cyber threat mitigation in smart healthcare networks

The rapid proliferation of the Internet of Medical Things (IoMT) has dramatically expanded the attack surface of smart healthcare networks, with cyber-threats including DDoS, spoofing, reconnaissance, and ransomware targeting IoMT infrastructures and jeopardizing patient safety. Traditional intrusion detection systems (IDS) fail to address protocol heterogeneity, high-dimensional traffic data, and severe class imbalance inherent in IoMT environments. This paper proposes GAN-Mamba Former-IDS, a novel intrusion detection framework for advanced cyber threat detection in smart healthcare networks. Three core innovations are integrated: (i) a Protocol-Aware Feature Router partitioning network traffic features into four semantically coherent protocol groups; (ii) a dual-stream Mamba-Transformer encoder concurrently capturing sequential dependencies via a linear-time state-space model and global feature interactions via multi-head self-attention; and (iii) Conditional Tabular GAN (CTGAN)-based augmentation addressing minority attack class imbalance. All experiments were implemented in PyTorch 2.1 on an NVIDIA A100 40GB GPU. The proposed framework achieves 97.71% accuracy, 0.7901 macro-F1 score, and 0.9842 ROC-AUC on the 19-class CICIoMT2024 test set, outperforming baseline models including MLP, 1D-CNN, BiLSTM, Transformer-only, and Mamba-only. CTGAN augmentation improves minority-class macro-F1 by up to +0.2109 for the rarest attack classes. Results are confirmed across five random seeds (mean ± std: Accuracy = 97.71 ± 0.38%, Macro-F1 = 0.7901 ± 0.014). GAN-Mamba Former-IDS provides a scalable, reproducible, and effective cybersecurity solution for next-generation IoMT environments, with demonstrated generalization across five heterogeneous IoT security benchmarks.