Characterization of Network Traffic Features for Intrusion Detection in IoMT Cybersecurity
TL;DR
This study characterizes the MedSec-25 dataset and identifies influential network-flow features for stage-aware IoMT intrusion detection and provides a practical IDS design guideline: an auditable pre-filter followed by a nonlinear classifier, assessed with MCC and AUPRC to better reflect minority attack stages.
Abstract
Network security in the Internet of Medical Things (IoMT) requires intrusion detection that is accurate and interpretable, yet IoMT traffic is often imbalanced and heavy-tailed, complicating feature selection and evaluation. This study characterizes the MedSec-25 dataset and identifies influential network-flow features for stage-aware IoMT intrusion detection. Using 10,000 stratified flows (approximately 40 features), we apply robust descriptive statistics and compare linear relevance (ANOVA F-score) with nonlinear relevance (Mutual Information), supported by correlation auditing and non-parametric testing. The data exhibit strong class imbalance (IR about 10.9:1) and predominantly non-Gaussian distributions. The overlap of ANOVA and MI highlights a compact, interpretable core of temporal and rate/volume indicators, while multivariate interactions help explain why many univariate Kruskal–Wallis tests are non-significant. Based on these findings, we provide a practical IDS design guideline: an auditable pre-filter followed by a nonlinear classifier, assessed with MCC and AUPRC to better reflect minority attack stages. The analysis offers a reproducible foundation for feature-driven IDS development in healthcare IoMT.