Flow Meets Graph: A Dynamic Fusion Relational Graph Convolutional Network for IoMT Intrusion Detection

Abstract

The rapid popularity of the Internet of Medical Things (IoMT) has introduced a "topology blind spot" in traditional Network Intrusion Detection Systems (NIDS), meaning they cannot distinguish attacks with similar statistical traffic configurations and completely different network topologies. To address this issue, this paper proposes a Hybrid Relational Graph Convolutional Network (RGCN), a dual-branch architecture that simultaneously learns flow-level statistical protocol behavior through a Multilayer Perceptron (MLP) and graph-level topology patterns through RGCN. Evaluated on the CICIoMT2024 dataset, Hybrid RGCN achieves 92.64% accuracy and 92.57% weighted F1-Score. In addition, experiments also validate the absolute advantage of graph neural networks in distinguishing between Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks, while also revealing a new "neighborhood contamination" challenge in graph-based detection under extreme class imbalance.