{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,9]],"date-time":"2026-10-09T17:24:31Z","timestamp":1791566671305,"version":"4.3.4"},"reference-count":37,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T00:00:00Z","timestamp":1784678400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Big Data"],"abstract":"<jats:sec>\n                    <jats:title>Introduction<\/jats:title>\n                    <jats:p>ARP spoofing poses a major security threat to Internet of Medical Things (IoMT) networks by enabling man-in-the-middle attacks that compromise the integrity of life-critical communications. Existing intrusion detection methods fail to simultaneously address temporal attack dynamics, unequal medical safety requirements, and explicit control of false negative rates.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>This study proposes the Self-Healing IoT-Optimized Random Forest (SH-IORF) framework, which integrates temporal behavioral feature engineering, validation-guided cost-sensitive learning, and medical safety-constrained threshold optimization. To ensure methodological rigor and prevent information leakage, a stratified three-way partitioning strategy consisting of training, validation, and completely held-out testing datasets was employed. Class penalty weights and operating thresholds were determined exclusively from the validation dataset.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>Experimental evaluation on the CICIoMT2024 benchmark demonstrated that the proposed SH-IORF framework achieved 99.90% accuracy, 99.83% recall, 99.95% precision, a 0.9989 F1-score, and an AUC-ROC of 0.9996. The framework limited the false negative rate to 0.17%, satisfying the predefined medical safety constraint (FNR \u2264 0.5%), corresponding to 40 missed detections among 23,390 attack samples and 12 false alarms across 28,768 benign traffic instances.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion<\/jats:title>\n                    <jats:p>The results demonstrate that the proposed framework provides stable and safety-oriented intrusion detection capability under heterogeneous IoMT deployment conditions while maintaining strict testing independence and robust performance under rigorous evaluation settings.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.3389\/fdata.2026.1878242","type":"journal-article","created":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T04:43:45Z","timestamp":1784695425000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["A cost-sensitive random forest framework for ARP spoofing detection in Internet of Medical Things networks"],"prefix":"10.3389","volume":"9","author":[{"given":"Siddhartha","family":"Singhal","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, Vellore Institute of Technology","place":["Vellore, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kakelli Anil","family":"Kumar","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Vellore Institute of Technology","place":["Vellore, India"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,7,22]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1007\/s10922-024-09874-0","article-title":"Enhancing network threat detection with random forest-based NIDS and permutation feature importance","volume":"33","author":"Abdelaziz","year":"2025","journal-title":"J. Netw. Syst. Manag."},{"key":"B2","doi-asserted-by":"publisher","first-page":"1726","DOI":"10.1038\/s41598-025-85866-7","article-title":"Signature-based intrusion detection using machine learning and deep learning approaches empowered with fuzzy clustering","volume":"15","author":"Ahmed","year":"2025","journal-title":"Sci. Rep"},{"key":"B3","doi-asserted-by":"publisher","first-page":"16899","DOI":"10.1038\/s41598-023-43816-1","article-title":"Robust genetic machine learning ensemble model for intrusion detection in network traffic","volume":"13","author":"Akhtar","year":"2023","journal-title":"Sci. Rep."},{"key":"B4","doi-asserted-by":"publisher","first-page":"100861","DOI":"10.1016\/j.iot.2023.100861","article-title":"ARP-PROBE: an ARP spoofing detector for Internet of Things networks using explainable deep learning","volume":"23","author":"Alani","year":"2023","journal-title":"Internet Things"},{"key":"B5","doi-asserted-by":"publisher","first-page":"2321381","DOI":"10.1080\/21642583.2024.2321381","article-title":"Enhancing intrusion detection in IoT networks using machine learning-based feature selection and ensemble models","volume":"12","author":"Almotairi","year":"2024","journal-title":"Syst. Sci. Control Eng."},{"key":"B6","doi-asserted-by":"publisher","first-page":"1850","DOI":"10.47738\/jads.v5i4.374","article-title":"ARP spoofing attack detection model in IoT network using machine learning: complexity vs. accuracy","volume":"5","author":"Alsaaidah","year":"2024","journal-title":"J. Appl. Data Sci"},{"key":"B7","doi-asserted-by":"publisher","first-page":"488","DOI":"10.1007\/s42452-025-07071-5","article-title":"An explainable AI-driven transformer model for spoofing attack detection in Internet of Medical Things (IoMT) networks","volume":"7","author":"Alsharaiah","year":"2025","journal-title":"Discov. Appl. Sci"},{"key":"B8","doi-asserted-by":"publisher","first-page":"101351","DOI":"10.1016\/j.iot.2024.101351","article-title":"CICIoMT2024: a benchmark dataset for multi-protocol security assessment in IoMT","volume":"28","author":"Dadkhah","year":"2024","journal-title":"Internet Things"},{"key":"B9","doi-asserted-by":"publisher","first-page":"327","DOI":"10.1007\/s11276-024-03764-8","article-title":"The internet of medical things (IoMT): opportunities and challenges","volume":"31","author":"El-Saleh","year":"2025","journal-title":"Wirel. Netw"},{"key":"B10","doi-asserted-by":"publisher","first-page":"43479","DOI":"10.1038\/s41598-025-28830-9","article-title":"SFARP: a multi-layered real-time security framework for hybrid ARP and DDoS attack defense in SD-IoT networks","volume":"15","author":"El-Sayed","year":"2025","journal-title":"Sci. Rep"},{"key":"B11","doi-asserted-by":"publisher","first-page":"110929","DOI":"10.1016\/j.compeleceng.2025.110929","article-title":"DiMCA: a novel P4-powered framework using machine learning for adaptive defense against combined DDoS and ARP spoofing attacks in SD-IoT networks","volume":"132","author":"Gafar","year":"2026","journal-title":"Comput. Electr. Eng"},{"key":"B12","doi-asserted-by":"publisher","first-page":"106990","DOI":"10.1016\/j.compeleceng.2021.106990","article-title":"Implementing an intrusion detection and prevention system using software-defined networking: defending against ARP spoofing attacks and blacklisted MAC addresses","volume":"90","author":"Girdler","year":"2021","journal-title":"Comput. Electr. Eng"},{"key":"B13","doi-asserted-by":"publisher","first-page":"1574","DOI":"10.3390\/math13101574","article-title":"Optimizing intrusion detection in IoMT networks through interpretable and cost-aware machine learning","volume":"13","author":"Hafid","year":"2025","journal-title":"Mathematics"},{"key":"B14","doi-asserted-by":"publisher","first-page":"100129","DOI":"10.1016\/j.teler.2024.100129","article-title":"Enhancing security in software-defined networks: an approach to efficient ARP spoofing attacks detection and mitigation","volume":"14","author":"Hnamte","year":"2024","journal-title":"Telemat. Inform. Rep"},{"key":"B15","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10462-023-10652-8","article-title":"Cost-sensitive learning for imbalanced medical data: a review","volume":"57","author":"Johnson","year":"2024","journal-title":"Artif. Intell. Rev."},{"key":"B16","doi-asserted-by":"publisher","first-page":"72427","DOI":"10.1109\/ACCESS.2025.3563721","article-title":"Real-time detection and identification of ARP spoofing attacks in microgrids","volume":"13","author":"Katuri","year":"2025","journal-title":"IEEE Access"},{"key":"B17","doi-asserted-by":"publisher","first-page":"28","DOI":"10.1007\/s44163-024-00120-9","article-title":"Self-healing hybrid intrusion detection system: an ensemble machine learning approach","volume":"4","author":"Kushal","year":"2024","journal-title":"Discov. Artif. Intell"},{"key":"B18","unstructured":"Temporal analysis of NetFlow datasets for network intrusion detection systems. arXiv [Preprint]\n          \n          \n            \n              Luay\n              M.\n            \n            \n              Layeghy\n              S.\n            \n            \n              Hosseininoorbin\n              S.\n            \n            \n              Sarhan\n              M.\n            \n            \n              Moustafa\n              N.\n            \n            \n              Portmann\n              M.\n            \n          \n          arXiv:2503.04404\n          \n          2025"},{"key":"B19","doi-asserted-by":"publisher","first-page":"109860","DOI":"10.1016\/j.compeleceng.2024.109860","article-title":"Optimizing random forests to detect intrusion in the Internet of Things","volume":"120","author":"Majidian","year":"2024","journal-title":"Comput. Electr. Eng"},{"key":"B20","doi-asserted-by":"publisher","first-page":"727","DOI":"10.1007\/s10115-024-02219-y","article-title":"ARP spoofing detection using machine learning classifiers: an experimental study","volume":"67","author":"Majumder","year":"2025","journal-title":"Knowl. Inf. Syst"},{"key":"B21","doi-asserted-by":"publisher","first-page":"2339","DOI":"10.1007\/s10586-022-03735-8","article-title":"Mitigating cyber threats through integration of feature selection and stacking ensemble learning: the LGBM and random forest intrusion detection perspective","volume":"26","author":"Mishra","year":"2023","journal-title":"Cluster Comput"},{"key":"B22","doi-asserted-by":"publisher","first-page":"49142","DOI":"10.1109\/ACCESS.2022.3172329","article-title":"D-ARP: an efficient scheme to detect and prevent ARP spoofing","volume":"10","author":"Morsy","year":"2022","journal-title":"IEEE Access"},{"key":"B23","doi-asserted-by":"publisher","first-page":"373","DOI":"10.1007\/s10207-023-00749-0","article-title":"GaTeBaSep: game theory-based security protocol against ARP spoofing attacks in software-defined networks","volume":"23","author":"Mvah","year":"","journal-title":"Int. J. Inf. Secur"},{"key":"B24","doi-asserted-by":"publisher","first-page":"103696","DOI":"10.1016\/j.cose.2023.103696","article-title":"Countering ARP spoofing attacks in software-defined networks using a game-theoretic approach","volume":"139","author":"Mvah","year":"","journal-title":"Comput. Secur"},{"key":"B25","doi-asserted-by":"publisher","first-page":"31039","DOI":"10.1038\/s41598-025-15292-2","article-title":"Hybrid deep learning-enabled framework for enhancing security, data integrity, and operational performance in Healthcare Internet of Things (H-IoT) environments","volume":"15","author":"Naik","year":"2025","journal-title":"Sci. Rep"},{"key":"B26","doi-asserted-by":"publisher","first-page":"115503","DOI":"10.1109\/ACCESS.2025.3585463","article-title":"A comprehensive approach for detecting and handling MitM-ARP spoofing attacks","volume":"13","author":"Oei","year":"2025","journal-title":"IEEE Access"},{"key":"B27","doi-asserted-by":"publisher","first-page":"104396","DOI":"10.1016\/j.jnca.2025.104396","article-title":"ARProof: a cross-protocol approach to detect and mitigate ARP-spoofing attacks in smart home networks","volume":"246","author":"Rahman","year":"2025","journal-title":"J. Netw. Comput. Appl"},{"key":"B28","doi-asserted-by":"publisher","first-page":"3147","DOI":"10.1007\/s10586-021-03328-x","article-title":"Denial of ARP spoofing in SDN and NFV enabled cloud-fog-edge platforms","volume":"24","author":"Rangisetti","year":"2021","journal-title":"Cluster Comput"},{"key":"B29","doi-asserted-by":"publisher","first-page":"e2745","DOI":"10.7717\/peerj-cs.2745","article-title":"Optimal intrusion detection for imbalanced data using Bagging method with deep neural network optimized by flower pollination algorithm","volume":"11","author":"Sayegh","year":"2025","journal-title":"PeerJ Comput. Sci."},{"key":"B30","doi-asserted-by":"publisher","first-page":"1467241","DOI":"10.3389\/fdgth.2024.1467241","article-title":"RCLNet: an effective anomaly-based intrusion detection for securing the IoMT system","volume":"6","author":"Shaikh","year":"2024","journal-title":"Front. Digit. Health"},{"key":"B31","first-page":"108","article-title":"\u201cToward generating a new intrusion detection dataset and intrusion traffic characterization,\u201d","volume-title":"Proceedings of the 4th international conference on information systems security and privacy (ICISSP)","author":"Sharafaldin","year":"2018"},{"key":"B32","doi-asserted-by":"publisher","first-page":"23","DOI":"10.1016\/j.dsm.2024.08.001","article-title":"Effects of feature selection and normalization on network intrusion detection","volume":"8","author":"Umar","year":"2025","journal-title":"Data Sci. Manag."},{"key":"B33","doi-asserted-by":"publisher","first-page":"61","DOI":"10.1177\/09266801241295886","article-title":"Identify spoofing attacks in Internet of Things (IoT) environments using machine learning algorithms","volume":"31","author":"Vajrobol","year":"2025","journal-title":"J. High Speed Netw"},{"key":"B34","doi-asserted-by":"publisher","first-page":"107392","DOI":"10.1016\/j.rineng.2025.107392","article-title":"A resilient IoT intrusion detection system using hybrid feature selection and explainable ensemble learning","volume":"28","author":"Wakili","year":"2025","journal-title":"Results Eng"},{"key":"B35","doi-asserted-by":"publisher","first-page":"104542","DOI":"10.1016\/j.cose.2025.104542","article-title":"Explainable AI and random forest based reliable intrusion detection system","volume":"157","author":"Wali","year":"2025","journal-title":"Comput. Secur"},{"key":"B36","doi-asserted-by":"publisher","first-page":"1173","DOI":"10.13052\/jcsm2245-1439.13516","article-title":"Industrial internet of things ARP virus attack detection method based on improved CNN BiLSTM","volume":"13","author":"Wang","year":"2024","journal-title":"J. Cyber Secur. Mobil"},{"key":"B37","doi-asserted-by":"publisher","first-page":"1145","DOI":"10.17775\/CSEEJPES.2020.03760","article-title":"Adaptive fault detection scheme using an optimized self-healing ensemble machine learning algorithm","volume":"8","author":"Yavuz","year":"2021","journal-title":"CSEE J. Power Energy Syst"}],"container-title":["Frontiers in Big Data"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fdata.2026.1878242\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T04:43:51Z","timestamp":1784695431000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fdata.2026.1878242\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,22]]},"references-count":37,"alternative-id":["10.3389\/fdata.2026.1878242"],"URL":"https:\/\/doi.org\/10.3389\/fdata.2026.1878242","relation":{},"ISSN":["2624-909X"],"issn-type":[{"value":"2624-909X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,22]]},"article-number":"1878242"}}