{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,3]],"date-time":"2026-08-03T23:59:02Z","timestamp":1785801542319,"version":"3.56.0"},"reference-count":44,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2026,1,26]],"date-time":"2026-01-26T00:00:00Z","timestamp":1769385600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Modern healthcare systems increasingly depend on wearable Internet of Medical Things (IoMT) devices for the continuous monitoring of patients\u2019 physiological parameters. It remains challenging to differentiate between genuine physiological anomalies, sensor faults, and malicious cyber interference. In this work, we propose a hybrid fusion framework designed to attribute the most plausible source of an anomaly, thereby supporting more reliable clinical decisions. The proposed framework is developed and evaluated using two complementary datasets: CICIoMT2024 for modelling security threats and a large-scale intensive care cohort from MIMIC-IV for analysing key vital signs and bedside interventions. The core of the system combines a supervised XGBoost classifier for attack detection with an unsupervised LSTM autoencoder for identifying physiological and technical deviations. To improve clinical realism and avoid artefacts introduced by quantised or placeholder measurements, the physiological module incorporates quality-aware preprocessing and missingness indicators. The fusion decision policy is calibrated under prudent, safety-oriented constraints to limit false escalation. Rather than relying on fixed fusion weights, we train a lightweight fusion classifier that combines complementary evidence from the security and clinical modules, and we select class-specific probability thresholds on a dedicated calibration split. The security module achieves high cross-validated performance, while the clinical model captures abnormal physiological patterns at scale, including deviations consistent with both acute deterioration and data-quality faults. Explainability is provided through SHAP analysis for the security module and reconstruction-error attribution for physiological anomalies. The integrated fusion framework achieves a final accuracy of 99.76% under prudent calibration and a Matthews Correlation Coefficient (MCC) of 0.995, with an average end-to-end inference latency of 84.69 ms (p95 upper bound of 107.30 ms), supporting near real-time execution in edge-oriented settings. While performance is strong, clinical severity labels are operationalised through rule-based proxies, and cross-domain fusion relies on harmonised alignment assumptions. These aspects should be further evaluated using realistic fault traces and prospective IoMT data. Despite these limitations, the proposed framework offers a practical and explainable approach for IoMT-based patient monitoring.<\/jats:p>","DOI":"10.3390\/info17020117","type":"journal-article","created":{"date-parts":[[2026,1,26]],"date-time":"2026-01-26T15:48:30Z","timestamp":1769442510000},"page":"117","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Intelligent Fusion: A Resilient Anomaly Detection Framework for IoMT Health Devices"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5343-7837","authenticated-orcid":false,"given":"Flavio","family":"Pastore","sequence":"first","affiliation":[{"name":"Department of Computer Science, German University of Technology in Oman, P.O. Box 1816, Muscat P.C 130, Oman"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5118-7739","authenticated-orcid":false,"given":"Raja Waseem","family":"Anwar","sequence":"additional","affiliation":[{"name":"Department of Computer Science, German University of Technology in Oman, P.O. Box 1816, Muscat P.C 130, Oman"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8238-6813","authenticated-orcid":false,"given":"Nafaa Hadi","family":"Jabeur","sequence":"additional","affiliation":[{"name":"Department of Computer Science, German University of Technology in Oman, P.O. Box 1816, Muscat P.C 130, Oman"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7905-7306","authenticated-orcid":false,"given":"Saqib","family":"Ali","sequence":"additional","affiliation":[{"name":"Department of Information Systems, Sultan Qaboos University, Muscat P.C 123, Oman"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,1,26]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"27468","DOI":"10.1109\/ACCESS.2020.2971654","article-title":"Health monitoring based on Internet of Medical Things: Architecture, enabling technologies, and applications","volume":"8","author":"Wei","year":"2020","journal-title":"IEEE Access"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Dinstag, G., Amar, D., Ingelsson, E., Ashley, E., and Shamir, R. (2019). Personalized prediction of adverse heart and kidney events using baseline and longitudinal data from SPRINT and ACCORD. PLoS ONE, 14.","DOI":"10.1371\/journal.pone.0219728"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"347","DOI":"10.1109\/TBCAS.2011.2114661","article-title":"Wireless sensor networks for monitoring physiological signals of multiple patients","volume":"5","author":"Dilmaghani","year":"2011","journal-title":"IEEE Trans. Biomed. Circuits Syst."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"297","DOI":"10.1007\/s41060-021-00265-1","article-title":"On the nature and types of anomalies: A review of deviations in data","volume":"12","author":"Foorthuis","year":"2021","journal-title":"Int. J. Data Sci. Anal."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"581","DOI":"10.1016\/j.future.2019.12.028","article-title":"Securing Internet of Medical Things systems: Limitations, issues and recommendations","volume":"105","author":"Yaacoub","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_6","first-page":"103405","article-title":"A dependable hybrid machine learning model for network intrusion detection","volume":"71","author":"Talukder","year":"2023","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Reddy, S., Kaza, V.S., Mohana, R.M., Alhameed, M., Jeribi, F., Alam, S., and Shuaib, M. (2025). Detecting anomalies in smart wearables for hypertension: A deep learning mechanism. Front. Public Health, 12.","DOI":"10.3389\/fpubh.2024.1426168"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"131","DOI":"10.1016\/j.jksuci.2022.11.007","article-title":"A fuzzy-based duo-secure multi-modal framework for IoMT anomaly detection","volume":"35","author":"Wagan","year":"2023","journal-title":"J. King Saud Univ. Comput. Inf. Sci."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"237","DOI":"10.1016\/j.inffus.2023.03.017","article-title":"An evaluation of ECG data fusion algorithms for wearable IoT sensors","volume":"96","author":"John","year":"2023","journal-title":"Inf. Fusion"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.medengphy.2016.12.011","article-title":"Application of data fusion techniques and technologies for wearable health monitoring","volume":"42","author":"King","year":"2017","journal-title":"Med. Eng. Phys."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"41111","DOI":"10.1109\/ACCESS.2025.3546681","article-title":"A literature review on applications of explainable artificial intelligence (XAI)","volume":"13","author":"Kalasampath","year":"2025","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"17403","DOI":"10.1007\/s11227-022-04568-3","article-title":"An investigation and comparison of machine learning approaches for intrusion detection in IoMT network","volume":"78","author":"Binbusayyis","year":"2022","journal-title":"J. Supercomput."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Koutras, D., Stergiopoulos, G., Dasaklis, T., Kotzanikolaou, P., Glynos, D., and Douligeris, C. (2020). Security in IoMT communications: A survey. Sensors, 20.","DOI":"10.3390\/s20174828"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"108996","DOI":"10.1016\/j.engappai.2024.108996","article-title":"Knowledge-based anomaly detection: Survey, challenges, and future directions","volume":"136","author":"Khan","year":"2024","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1186\/s40537-024-00886-w","article-title":"Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction","volume":"11","author":"Talukder","year":"2024","journal-title":"J. Big Data"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1052","DOI":"10.1109\/JSYST.2013.2257594","article-title":"Intrusion detection in cyber-physical systems: Techniques and challenges","volume":"8","author":"Han","year":"2014","journal-title":"IEEE Syst. J."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"70341","DOI":"10.1038\/s41598-024-70341-6","article-title":"A comparison between machine and deep learning models on high stationarity data","volume":"14","author":"Santoro","year":"2024","journal-title":"Sci. Rep."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"100719","DOI":"10.1016\/j.ijcip.2024.100719","article-title":"Process-aware security monitoring in industrial control systems: A systematic review and future directions","volume":"47","year":"2024","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1007\/s10462-024-11101-w","article-title":"A comprehensive and systematic literature review on intrusion detection systems in the internet of medical things: Current status, challenges, and opportunities","volume":"58","author":"Naghib","year":"2025","journal-title":"Artif. Intell. Rev."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Goudarzi, M., Shaghaghi, A., Finn, S., Stillerd, B., and Jha, S. (2024, January 24\u201326). Towards threat modelling of IoT context-sharing platforms. Proceedings of the IEEE 23rd International Symposium on Network Computing and Applications (NCA), Bertinoro, Italy.","DOI":"10.1109\/NCA61908.2024.00025"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Hasan, M., Li, F., Gouverneur, P., Piet, A., and Grzegorzek, M. (2025). A comprehensive survey and comparative analysis of time series data augmentation in medical wearable computing. PLoS ONE, 20.","DOI":"10.1371\/journal.pone.0315343"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Brekke, I.J., Puntervoll, L.H., Pedersen, P.B., Kellett, J., and Brabrand, M. (2019). The value of vital sign trends in predicting and monitoring clinical deterioration: A systematic review. PLoS ONE, 14.","DOI":"10.1371\/journal.pone.0210875"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1038\/s41597-022-01899-x","article-title":"MIMIC-IV, a freely accessible electronic health record dataset","volume":"10","author":"Johnson","year":"2023","journal-title":"Sci. Data"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Rim, B., Sung, N.J., Min, S.D., and Lee, M. (2020). Deep learning in physiological signal data: A survey. Sensors, 20.","DOI":"10.3390\/s20040969"},{"key":"ref_25","first-page":"85","article-title":"Deep learning-based anomaly detection in cyber-physical systems: Progress and opportunities","volume":"54","author":"Luo","year":"2021","journal-title":"ACM Comput. Surv."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"20220878","DOI":"10.1259\/bjr.20220878","article-title":"Data drift in medical machine learning: Implications and potential remedies","volume":"96","author":"Sahiner","year":"2023","journal-title":"Br. J. Radiol."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Charlton, P.H., Marozas, V., Mej\u00eda-Mej\u00eda, E., Kyriacou, P.A., and Mant, J. (2025). Determinants of photoplethysmography signal quality at the wrist. PLoS Digit. Health, 4.","DOI":"10.1371\/journal.pdig.0000585"},{"key":"ref_28","first-page":"15","article-title":"Deep learning for time series anomaly detection: A survey","volume":"56","author":"Webb","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"106484","DOI":"10.1016\/j.engappai.2023.106484","article-title":"ECG-NET: A deep LSTM autoencoder for detecting anomalous ECG","volume":"124","author":"Roy","year":"2023","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"102060","DOI":"10.1016\/j.inffus.2023.102060","article-title":"Insights into Internet of Medical Things (IoMT): Data fusion, security issues and potential solutions","volume":"102","author":"Ahmed","year":"2024","journal-title":"Inf. Fusion"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Senel, N., Kefferp\u00fctz, K., Doycheva, K., and Elger, G. (2023). Multi-sensor data fusion for real-time multi-object tracking. Processes, 11.","DOI":"10.3390\/pr11020501"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1109\/5.554205","article-title":"An introduction to multisensor data fusion","volume":"85","author":"Hall","year":"1997","journal-title":"Proc. IEEE"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"113887","DOI":"10.1016\/j.eswa.2020.113887","article-title":"Fault matters: Sensor data fusion for detection of faults using Dempster\u2013Shafer theory of evidence in IoT-based applications","volume":"162","author":"Ghosh","year":"2020","journal-title":"Expert Syst. Appl."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"3488","DOI":"10.1016\/j.matpr.2021.05.564","article-title":"Wireless body area network (WBAN): A review of schemes and protocols","volume":"49","author":"Singh","year":"2022","journal-title":"Mater. Today Proc."},{"key":"ref_35","unstructured":"Canadian Institute for Cybersecurity (2024). CIC IoMT 2024 Dataset, University of New Brunswick. Available online: https:\/\/www.unb.ca\/cic\/datasets\/iomt-dataset-2024.html."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"101351","DOI":"10.1016\/j.iot.2024.101351","article-title":"CICIoMT2024: A benchmark dataset for multi-protocol security assessment in IoMT","volume":"27","author":"Dadkhah","year":"2024","journal-title":"Internet Things"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Sohail, F., Bhatti, M.A.M., Awais, M., and Iqtidar, A. (2024, January 22\u201323). Explainable boosting ensemble methods for intrusion detection in Internet of Medical Things (IoMT) applications. Proceedings of the 4th International Conference on Digital Futures and Transformative Technologies (ICoDT2), Islamabad, Pakistan.","DOI":"10.1109\/ICoDT262145.2024.10740251"},{"key":"ref_38","unstructured":"Johnson, A., Bulgarelli, L., Pollard, T., Gow, B., Moody, B., Horng, S., Celi, L.A., and Mark, R. (MIMIC-IV, 2024). MIMIC-IV, version 3.1."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Chicco, D., and Jurman, G. (2020). The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC Genom., 21.","DOI":"10.1186\/s12864-019-6413-7"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"126718","DOI":"10.1016\/j.eswa.2025.126718","article-title":"A comparative analysis of machine learning techniques for detecting probing attack with SHAP algorithm","volume":"271","author":"Rabbi","year":"2025","journal-title":"Expert Syst. Appl."},{"key":"ref_42","first-page":"102","article-title":"A comparative evaluation of the boosting algorithms for network attack classification","volume":"6","year":"2022","journal-title":"Int. J. 3D Print. Technol. Digit. Ind."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Moreno Haro, L.M., Oliveira-Filho, A., Agard, B., and Tahan, A. (2025). Failure detection in sensors via variational autoencoders and image-based feature representation. Sensors, 25.","DOI":"10.3390\/s25072175"},{"key":"ref_44","first-page":"3371","article-title":"Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion","volume":"11","author":"Vincent","year":"2010","journal-title":"J. Mach. Learn. Res."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/2\/117\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,26]],"date-time":"2026-01-26T16:01:10Z","timestamp":1769443270000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/2\/117"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,26]]},"references-count":44,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2026,2]]}},"alternative-id":["info17020117"],"URL":"https:\/\/doi.org\/10.3390\/info17020117","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,26]]}}}