Attentive temporal patch filtering for explainable streaming intrusion detection in medical IoT traffic
Year: 2026
Type: article
Abstract: Network traffic in the Internet of Medical Things (IoMT) forms an unbounded multivariate temporal sequence whose statistics shift across devices, protocols, and acquisition environments; detecting malicious segments within it is a streaming time-series classification problem constrained by bounded per-window latency, essential for temporally localized explanations, and robustness to distribution shift. This research work presents TAPX-Net, a window-local classifier that decomposes each traffic window into temporal patches, applies channel-attentive depthwise convolutional filtering, and models the patch sequence with stacked bidirectional recurrent layers before attention pooling and dual classification and reconstruction heads. Each window is classified independently, with recurrent states reset at every window boundary, making the model window-causal. A temporal attribution module (TAM) produces patch- and feature-level explanations through Integrated Gradients (IG), validated against a causal input-level ablation. A feature-harmonized adaptation stage transfers the trained model to new network environments through limited-label fine-tuning with Maximum Mean Discrepancy alignment. On the CICIoMT2024 benchmark, TAPX-Net reaches a recall of 0.9541 at an FPR of one percent and a zero-day recall of 0.8963 across ten held-out attack classes, exceeding 7 baselines on every detection metric, and under CPU-only inference on the tested configuration processes a continuous stream at 108.7 windows per second with 98.8 percent of decisions within a 10 ms per-window bound. IG tracks the causal ablation more closely than attention weights (AW) across all attack classes, and cross-dataset transfer (CDT) to the general-purpose UNSW-NB15 and ToN-IoT benchmarks recovers most of the achievable performance gain with 5,000 labeled target windows. The reconstruction head contributes a 7.46 percentage point improvement in zero-day recall, focused on the generalization regime.
Source: Scientific Reports
Authors: Saranya Palaniappan, Sudhakar Sengan
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,690
OpenAlex ID: W7223184952