Leakage-aware and imbalance-robust gradient boosting for intrusion detection in cyber-physical healthcare systems under adversarial AI threats

Abstract

Cyber-physical healthcare systems (CPHS) increasingly depend on machine-learning intrusion detection systems (IDS) to protect networked medical devices and patient-monitoring infrastructure. Yet the IDS itself introduces a new attack surface: it is exposed to AI-specific threats—data poisoning, adversarial evasion, and model hijacking (backdoors)—and its reported accuracy is frequently inflated by undetected label leakage and by class imbalance handled in ways that distort the operating point. We present a leakage-aware, imbalance-robust detection pipeline for the WUSTL-EHMS-2020 healthcare CPS dataset (16,318 flows; 35 network-flow and 8 biometric features; 12.5% attack prevalence) and we audit it against all three threat families. A depth-one decision-stump audit identifies and removes a source-MAC column that alone predicts the label with accuracy 1.0 (a textbook leak), restoring honest evaluation. Class imbalance is handled inside a gradient-boosted detector through cost-sensitive re-weighting (scale_pos_weight) rather than aggressive synthetic balancing, which we show is the cause of the low attack-class precision otherwise observed. The tuned detector attains held-out accuracy 0.973, attack-class precision 0.87, recall 0.93, \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$F_1=0.90$$\end{document}, and AUC 0.992, and is the statistically best model across a ten-classifier benchmark (Friedman \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\chi ^2=86.55$$\end{document}, \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$p\approx 8\times 10^{-15}$$\end{document}; pairwise Wilcoxon \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$p=0.002$$\end{document}, significant after Bonferroni correction for nine simultaneous comparisons). Threat auditing on this dataset reveals a layered risk profile: label-flipping degrades \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$F_1$$\end{document} modestly, adversarial evasion peaks at 0.45 under a large-budget FGSM attack, and all backdoor triggers achieve \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$100\%$$\end{document} bypass at \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$1\%$$\end{document} poisoning while preserving clean-traffic utility—a silent compromise that clean-data monitoring cannot detect; full backdoor defences (activation clustering, trigger reverse-engineering) are identified as priority future work rather than implemented here. As a model-agnostic defensive layer we add a randomized-smoothing conformal-prediction abstainer (\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$K=100$$\end{document} smoothing draws, \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\sigma =0.15$$\end{document}) that holds its \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$95\%$$\end{document} coverage guarantee (empirical 0.955) and re-flags evaded flows the point classifier misses. We further show that a per-sample detector calibrated to a \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$5\%$$\end{document} false-alarm rate tracks true evasion, whereas distribution-level tests fire on any perturbation regardless of success. The findings are grounded in a single healthcare cyber-physical benchmark and should be interpreted with appropriate caution before generalising to other datasets or attack repertoires; the methodology, however, is dataset-agnostic and directly transferable.