AI-based intrusion detection systems for medical IoT networks: a performance analysis

In healthcare, the security challenges created by extensive and varied Internet of Things (IoT) networks directly threaten patient well-being and data confidentiality. This paper compares the intrusion detection performance of Random Forest (RF), RNN-GRU and TabTransformer AI models across real-time (RT-IoT2022), medical (CIC-IoMT2024), general-purpose (CIC-IoT2023) and industrial (Edge-IIoT) IoT datasets. Each algorithm was evaluated for its ability to detect attacks using multiclass and binary classification tasks. Although performance decreased in multiclass tasks, the binary classification results were strong (0.93 average F1 score and 0.96 average accuracy). RF achieved the highest scores (F1 score 0.82 and accuracy 0.97). In contrast, RNN-GRU (F1 score 0.66, accuracy 0.81) and TT (F1 score 0.68, accuracy 0.82) performed less effectively. Within the Medical IoT domain, all models struggled to detect low-intensity, infrequent reconnaissance and distributed attacks. This reveals a significant vulnerability in clinical systems. The conclusion is that complex deep learning models are not inherently superior for IoT security. These findings suggest that a simpler model, paired with domain-specific, high-quality data, may provide solid and effective basis for intrusion detection in healthcare settings.