Hybrid Machine-Learning Based Detection for Hospital Networks Threat Mitigations

Abstract

This research presents a hybrid machine learning-based intrusion detection system for real-time hospital network security. Most hospital security systems still rely on outdated signature-based detection, even though hospital networks are more connected compared to ever and that connectivity carries heavy risks. Cyber threats like DDoS attacks, brute-force attacks, and data theft have become more advanced. but hospitals still make use of techniques that are just unable to keep up with real-time evolving threats or zero-day vulnerabilities. The CIC-IDS2017 dataset was used to carry out research, which comprises more than 216,000 network flow records. The research used a quantitative experimental approach. Random Forest was used as a baseline for comparison, while XGBoost was implemented for supervised multiclass classification and Isolation Forest for anomaly detection. The system was further refined through feature engineering, PCA dimensionality reduction, and calibrated decision thresholds. After carrying out the necessary tests from the datasets needed for the research, results showed that the new hybrid system achieved aggregate F1-score improvement from 0.788 in the existing system to 0.903, while reducing mean detection latency for exfiltration attacks from 48 seconds to under 15 seconds, of which is a great improvement. The developed system also provided real-time monitoring, SHAP explainability, alert management, and downloadable incident reporting through a FastAPI-powered dashboard. The study concluded that hybrid machine learning significantly improves hospital intrusion detection performance compared to traditional systems. Future work should integrate federated learning and larger healthcare datasets for broader scalability across different environments