{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T01:18:44Z","timestamp":1773105524198,"version":"3.50.1"},"reference-count":47,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T00:00:00Z","timestamp":1773014400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["MAKE"],"abstract":"<jats:p>The rapid growth of Internet of Medical Things (IoMT) devices has revolutionized diagnostics and patient care within smart healthcare networks. However, this progress has also expanded the attack surface due to the heterogeneity and interconnectivity of medical devices. To overcome the limitations of traditional batch-trained security models, this study proposes an adaptive online intrusion detection framework designed for real-time operation in dynamic healthcare environments. The system combines Leveraging Bagging with Hoeffding Tree classifiers for incremental learning while integrating the Page\u2013Hinkley test to detect and adapt to concept drift in evolving attack patterns. A modular and scalable network architecture supports centralized monitoring and ensures seamless interoperability across various IoMT protocols. Implemented within a low-latency, high-throughput stream-processing pipeline, the framework meets the stringent clinical requirements for responsiveness and reliability. To simulate streaming conditions, we evaluated the model using the CICIoMT2024 dataset, presenting one instance at a time in random order to reflect dynamic, real-time traffic in IoMT networks. Experimental results demonstrate exceptional performance, achieving accuracies of 0.9963 for binary classification, 0.9949 for six-class detection, and 0.9860 for nineteen-class categorization. These results underscore the framework\u2019s practical efficacy in protecting modern healthcare infrastructures from evolving cyber threats.<\/jats:p>","DOI":"10.3390\/make8030067","type":"journal-article","created":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T13:27:18Z","timestamp":1773062838000},"page":"67","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Drift-Aware Online Ensemble Learning for Real-Time Cybersecurity in Internet of Medical Things Networks"],"prefix":"10.3390","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3594-0137","authenticated-orcid":false,"given":"Fazliddin","family":"Makhmudov","sequence":"first","affiliation":[{"name":"Department of Computer Engineering, Gachon University, Seongnam 1342, Republic of Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8767-2456","authenticated-orcid":false,"given":"Gayrat","family":"Juraev","sequence":"additional","affiliation":[{"name":"Department of Artificial Intelligence, Tashkent State University of Economics, Tashkent 100066, Uzbekistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-7146-2106","authenticated-orcid":false,"given":"Ozod","family":"Yusupov","sequence":"additional","affiliation":[{"name":"Department of Software Engineering, Samarkand State University, Samarkand 140104, Uzbekistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-6418-7883","authenticated-orcid":false,"given":"Parvina","family":"Nasriddinova","sequence":"additional","affiliation":[{"name":"Department of Cybersecurity and Criminology, Tashkent University of Information Technologies, Tashkent 100084, Uzbekistan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8284-8109","authenticated-orcid":false,"given":"Dusmurod","family":"Kilichev","sequence":"additional","affiliation":[{"name":"Department of Information Security, National University of Uzbekistan, Tashkent 100174, Uzbekistan"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,3,9]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Sallabi, F.M., Khater, H.M., Tariq, A., Hayajneh, M., Shuaib, K., and Barka, E.S. (2025). Smart Healthcare Network Management: A Comprehensive Review. Mathematics, 13.","DOI":"10.3390\/math13060988"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Gallo, G.D., and Micucci, D. (2025). Internet of Medical Things Systems Review: Insights into Non-Functional Factors. Sensors, 25.","DOI":"10.3390\/s25092795"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Cheng, H., Qu, Y., Liu, W., Gao, L., and Zhu, T. (2025). Decentralized Federated Learning for Private Smart Healthcare: A Survey. Mathematics, 13.","DOI":"10.3390\/math13081296"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Attaallah, A., al Sulbi, K., Alasiry, A., Marzougui, M., Ansar, S.A., Agrawal, A., Ansari, M.T.J., and Khan, R.A. (2023). Fuzzy-Based Unified Decision-Making Technique to Evaluate Security Risks: A Healthcare Perspective. Mathematics, 11.","DOI":"10.3390\/math11112554"},{"key":"ref_5","unstructured":"(2024, August 06). Cost of a Data Breach: The Healthcare Industry. Available online: https:\/\/www.ibm.com\/think\/insights\/cost-of-a-data-breach-healthcare-industry."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Zachos, G., Mantas, G., Porfyrakis, K., and Rodriguez, J. (2025). Implementing Anomaly-Based Intrusion Detection for Resource-Constrained Devices in IoMT Networks. Sensors, 25.","DOI":"10.3390\/s25041216"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Nasajpour, M., Pouriyeh, S., Parizi, R.M., Han, M., Mosaiyebzadeh, F., Liu, L., Xie, Y., and Batista, D.M. (2025). Federated Learning in Smart Healthcare: A Survey of Applications, Challenges, and Future Directions. Electronics, 14.","DOI":"10.3390\/electronics14091750"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Xie, Q., Ding, Z., and Xie, Q. (2023). A Lightweight and Privacy-Preserving Authentication Protocol for Healthcare in an IoT Environment. Mathematics, 11.","DOI":"10.3390\/math11183857"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Kajornkasirat, S., Sawangwong, C., Puangsuwan, K., Chanapai, N., Phutthamongkhon, W., and Puttinaovarat, S. (2025). Integrating AI-Driven Predictive Analytics in Wearable IoT for Real-Time Health Monitoring in Smart Healthcare Systems. Appl. Sci., 15.","DOI":"10.3390\/app15084400"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Makhmudov, F., Kilichev, D., Giyosov, U., and Akhmedov, F. (2025). Online Machine Learning for Intrusion Detection in Electric Vehicle Charging Systems. Mathematics, 13.","DOI":"10.3390\/math13050712"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Urooj, U., Al-rimy, B.A.S., Gazzan, M., Zainal, A., Amer, E., Almutairi, M., Shiaeles, S., and Sheldon, F. (2025). A Wide and Weighted Deep Ensemble Model for Behavioral Drifting Ransomware Attacks. Mathematics, 13.","DOI":"10.3390\/math13071037"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Balc\u00e1zar, J.L., Bonchi, F., Gionis, A., and Sebag, M. (2010). Leveraging Bagging for Evolving Data Streams. Proceedings of the Machine Learning and Knowledge Discovery in Databases, Springer.","DOI":"10.1007\/978-3-642-15880-3"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Kryszkiewicz, M., Appice, A., \u015al\u0119zak, D., Rybinski, H., Skowron, A., and Ra\u015b, Z.W. (2017). Supporting the Page-Hinkley Test with Empirical Mode Decomposition for Change Detection. Proceedings of the Foundations of Intelligent Systems, Springer.","DOI":"10.1007\/978-3-319-60438-1"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Alalwany, E., Alsharif, B., Alotaibi, Y., Alfahaid, A., Mahgoub, I., and Ilyas, M. (2025). Stacking Ensemble Deep Learning for Real-Time Intrusion Detection in IoMT Environments. Sensors, 25.","DOI":"10.3390\/s25030624"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1802","DOI":"10.1007\/s13198-023-02119-4","article-title":"Machine learning based intrusion detection system for IoMT","volume":"15","author":"Kulshrestha","year":"2024","journal-title":"Int. J. Syst. Assur. Eng. Manag."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Kilichev, D., and Kim, W. (2023). Hyperparameter Optimization for 1D-CNN-Based Network Intrusion Detection Using GA and PSO. Mathematics, 11.","DOI":"10.3390\/math11173724"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Kilichev, D., Turimov, D., and Kim, W. (2024). Next\u2013Generation Intrusion Detection for IoT EVCS: Integrating CNN, LSTM, and GRU Models. Mathematics, 12.","DOI":"10.3390\/math12040571"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"2049","DOI":"10.1109\/TCE.2024.3350231","article-title":"A Blended Deep Learning Intrusion Detection Framework for Consumable Edge-Centric IoMT Industry","volume":"70","author":"Alzubi","year":"2024","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_19","first-page":"171","article-title":"Efficient Intrusion Detection using OptCNN-LSTM Model based on hybrid Correlation-based Feature Selection in IoMT","volume":"16","author":"Almotairi","year":"2024","journal-title":"Fusion Pract. Appl."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Alalhareth, M., and Hong, S.C. (2024). Enhancing the Internet of Medical Things (IoMT) Security with Meta-Learning: A Performance-Driven Approach for Ensemble Intrusion Detection Systems. Sensors, 24.","DOI":"10.3390\/s24113519"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"12341","DOI":"10.1007\/s10586-024-04512-5","article-title":"An effective classification using enhanced elephant herding optimization with convolution neural network for intrusion detection in IoMT architecture","volume":"27","year":"2024","journal-title":"Clust. Comput."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"23080","DOI":"10.1109\/JIOT.2024.3387294","article-title":"Meta-IDS: Meta-Learning-Based Smart Intrusion Detection System for Internet of Medical Things (IoMT) Network","volume":"11","author":"Zukaib","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"36523","DOI":"10.1007\/s11042-024-19916-z","article-title":"Towards robust and efficient intrusion detection in IoMT: A deep learning approach addressing data leakage and enhancing model generalizability","volume":"84","author":"Bouke","year":"2024","journal-title":"Multimed. Tools Appl."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"25454","DOI":"10.1109\/JIOT.2023.3327024","article-title":"An Intelligent and Explainable SaaS-Based Intrusion Detection System for Resource-Constrained IoMT","volume":"11","author":"Aljuhani","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"102659","DOI":"10.1016\/j.rineng.2024.102659","article-title":"An RFE\/Ridge-ML\/DL based anomaly intrusion detection approach for securing IoMT system","volume":"23","author":"Lazrek","year":"2024","journal-title":"Results Eng."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Balhareth, G., and Ilyas, M. (2024). Optimized Intrusion Detection for IoMT Networks with Tree-Based Machine Learning and Filter-Based Feature Selection. Sensors, 24.","DOI":"10.3390\/s24175712"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Alsolami, T., Alsharif, B., and Ilyas, M. (2024). Enhancing Cybersecurity in Healthcare: Evaluating Ensemble Learning Models for Intrusion Detection in the Internet of Medical Things. Sensors, 24.","DOI":"10.3390\/s24185937"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"152482","DOI":"10.1109\/ACCESS.2024.3480011","article-title":"Enhanced Multigrained Scanning-Based Deep Stacking Network for Intrusion Detection in IoMT Networks","volume":"12","author":"Musikawan","year":"2024","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"32863","DOI":"10.1109\/ACCESS.2025.3543127","article-title":"HIDS-IoMT: A Deep Learning-Based Intelligent Intrusion Detection System for the Internet of Medical Things","volume":"13","author":"Berguiga","year":"2025","journal-title":"IEEE Access"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Abdusalomov, A., Mirzakhalilov, S., Umirzakova, S., Shavkatovich Buriboev, A., Meliboev, A., Muminov, B., and Jeon, H.S. (2025). Accessible AI Diagnostics and Lightweight Brain Tumor Detection on Medical Edge Devices. Bioengineering, 12.","DOI":"10.3390\/bioengineering12010062"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"104526","DOI":"10.1016\/j.cose.2025.104526","article-title":"Identifying communication sequence anomalies to detect DoS attacks against MQTT","volume":"157","author":"Swain","year":"2025","journal-title":"Comput. Secur."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"108125","DOI":"10.1016\/j.comcom.2025.108125","article-title":"IoT edge network interoperability","volume":"236","author":"Azad","year":"2025","journal-title":"Comput. Commun."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Marwat, S.N.K., Mehmood, Y., Ullah, F., Khan, A., Khan, S., Ahmed, S., Kwak, D., and Nazir, A. (2020). Mobile Wi-Fi Based Scheduling of Cyber-Physical Systems in Healthcare. Electronics, 9.","DOI":"10.3390\/electronics9020247"},{"key":"ref_34","first-page":"1601","article-title":"MOA: Massive Online Analysis","volume":"11","author":"Bifet","year":"2010","journal-title":"J. Mach. Learn. Res."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"101351","DOI":"10.1016\/j.iot.2024.101351","article-title":"CICIoMT2024: A benchmark dataset for multi-protocol security assessment in IoMT","volume":"28","author":"Dadkhah","year":"2024","journal-title":"Internet Things"},{"key":"ref_36","unstructured":"Koucheryavy, Y., and Aziz, A. (2024). Development of Fully Synthetic Medical Database Shuffling Method. Proceedings of the Internet of Things, Smart Spaces, and Next Generation Networks and Systems, Springer."},{"key":"ref_37","first-page":"1","article-title":"River: Machine learning for streaming data in Python","volume":"22","author":"Montiel","year":"2021","journal-title":"J. Mach. Learn. Res."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Hossain, M.T., Meem, S.M., Setu, J.H., Halder, N., Islam, A., and Alam, M.Z. (2024, January 3\u20135). Cyberattacks Classification on Internet of Medical Things Using Information Gain Feature Selection and Machine Learning. Proceedings of the 2024 Advances in Science and Engineering Technology International Conferences (ASET), Abu Dhabi, United Arab.","DOI":"10.1109\/ASET60340.2024.10708692"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Gomez, A.S., Gutierrez Portela, F., and Diaz Triana, O.A. (2024). Intrusion Detection System for IoT using Anomaly Detection Techniques. Proceedings of the 2024 IEEE VII Congreso Internacional en Inteligencia Ambiental, Ingenier\u00eda de Software y Salud Electr\u00f3nica y M\u00f3vil (AmITIC), David, Panama, 25\u201327 September 2024, IEEE.","DOI":"10.1109\/AmITIC62658.2024.10747648"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"153886","DOI":"10.1109\/ACCESS.2024.3480889","article-title":"Enhancing Machine Learning Approach Based on Nilsimsa Fingerprinting for Ransomware Detection in IoMT","volume":"12","year":"2024","journal-title":"IEEE Access"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Sohail, F., Bhatti, M.A.M., Awais, M., and Iqtidar, A. (2024). Explainable Boosting Ensemble Methods for Intrusion Detection in Internet of Medical Things (IoMT) Applications. Proceedings of the 2024 4th International Conference on Digital Futures and Transformative Technologies (ICoDT2), Islamabad, Pakistan, 22\u201323 October 2024, IEEE.","DOI":"10.1109\/ICoDT262145.2024.10740251"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Mohammadi, A., Ghahramani, H., Asghari, S.A., and Aminian, M. (2024). Securing Healthcare with Deep Learning: A CNN-Based Model for Medical IoT Threat Detection. Proceedings of the 2024 19th Iranian Conference on Intelligent Systems (ICIS), Sirjan, Iran, 23\u201324 October 2024, IEEE.","DOI":"10.1109\/ICIS64839.2024.10887510"},{"key":"ref_43","first-page":"2185","article-title":"Augmenting Internet of Medical Things Security: Deep Ensemble Integration and Methodological Fusion","volume":"141","author":"Hamad","year":"2024","journal-title":"Comput. Model. Eng. Sci."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Kalakoti, R., N\u00f5mm, S., and Bahsi, H. (2024). Explainable Transformer-based Intrusion Detection in Internet of Medical Things (IoMT) Networks. Proceedings of the 2024 International Conference on Machine Learning and Applications (ICMLA), Miami, FL, USA, 18\u201320 December 2024, IEEE.","DOI":"10.1109\/ICMLA61862.2024.00179"},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"7002","DOI":"10.1109\/ACCESS.2025.3526883","article-title":"L2D2: A Novel LSTM Model for Multi-Class Intrusion Detection Systems in the Era of IoMT","volume":"13","author":"Akar","year":"2025","journal-title":"IEEE Access"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"219","DOI":"10.1007\/s10586-024-04904-7","article-title":"Network Intrusion Detection System Using Convolutional Neural Networks: NIDS-DL-CNN for IoT Security","volume":"28","author":"Kharoubi","year":"2025","journal-title":"Clust. Comput."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"117761","DOI":"10.1109\/ACCESS.2024.3422999","article-title":"Optimizing Smart Home Intrusion Detection with Harmony-Enhanced Extra Trees","volume":"12","author":"Abdusalomov","year":"2024","journal-title":"IEEE Access"}],"container-title":["Machine Learning and Knowledge Extraction"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-4990\/8\/3\/67\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T14:01:48Z","timestamp":1773064908000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-4990\/8\/3\/67"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,9]]},"references-count":47,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2026,3]]}},"alternative-id":["make8030067"],"URL":"https:\/\/doi.org\/10.3390\/make8030067","relation":{},"ISSN":["2504-4990"],"issn-type":[{"value":"2504-4990","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,9]]}}}