Attention-enhanced deep learning model for MQTT intrusion detection in internet of medical things

Abstract

The increasing utilization of the Message Queuing Telemetry Transport (MQTT) protocol in IoMT has created a high demand for efficient intrusion detection systems (IDSs). This study proposes a protocol-specific intrusion detection system (IDS) that employs a hybrid deep learning architecture consisting of a one-dimensional convolutional neural network along with a multi-head self-attention mechanism (CNN-MHSA). The architecture employs a convolutional feature-extraction module to derive local traffic features and a multi-head self-attention mechanism to capture long-range feature correlations. The proposed approach is evaluated on the CICIoMT2024 dataset, focusing mainly on the MQTT attack scenarios that are framed as a binary classification problem, in which five distinct MQTT attack variants (DoS-Connect Flood, DDoS-Connect Flood, DoS-Publish Flood, DDoS-Publish Flood, and Malformed Data) were consolidated into a single attack class against benign traffic. The test results show an accuracy of 99.40%, an F1-score of 99.52%, and an AUC of 0.9998, respectively, for the proposed method. The results indicate that the proposed CNN–MHSA framework offers a robust benchmark for secure healthcare communication and can successfully identify MQTT threats in IoMT networks.