{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,14]],"date-time":"2026-08-14T11:33:24Z","timestamp":1786707204129,"version":"build-2736575974"},"reference-count":54,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2026,8,14]],"date-time":"2026-08-14T00:00:00Z","timestamp":1786665600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Deanship of Scientific Research at Imam Mohammad Ibn Saud Islamic University","award":["IMSIU-DDRSP2601"],"award-info":[{"award-number":["IMSIU-DDRSP2601"]}]},{"award":["IMSIU-DDRSP2601"],"award-info":[{"award-number":["IMSIU-DDRSP2601"]}],"id":[{"id":"https:\/\/ror.org\/05gxjyb39","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Bioengineering"],"abstract":"<jats:p>The Internet of Medical Things (IoMT) is a promising technology for enabling smart and efficient healthcare systems through continuous physiological monitoring, early anomaly detection, and proactive patient management. However, IoMT sensors are vulnerable to False Data Injection Attacks (FDIAs), in which adversaries can manipulate sensor measurements to compromise diagnostic accuracy, mislead clinical decision-making, and threaten patient safety. Existing detection approaches often rely on population-level statistical models that may not fully capture individual physiological variations or residual-based thresholds designed for relatively simple attack scenarios, limiting their ability to exploit the spatio-temporal dependencies of multi-sensor physiological streams and detect stealthy or adversarial FDIAs. This paper proposes a patient-specific FDIA detection framework based on a Graph Convolutional Network\u2013Gated Recurrent Unit (GCN\u2013GRU) digital twin that learns an individual patient\u2019s normal physiological behaviour from clean baseline telemetry. The trained digital twin is integrated into a Kalman filter as the state prediction model, and the resulting standardised innovation residuals are used as detection features. To characterise stealthy attack behaviours, four complementary window-based feature groups are extracted from the innovation sequence: innovation statistics, sensor correlation drift, temporal smoothness, and uncertainty mismatch. A CNN-1D classifier is then trained to learn discriminative temporal attack patterns from these features for accurate detection. A structured attack taxonomy comprising five stealthy and adversarial FDIA scenarios is developed, where attacks are injected as smooth gradual or abrupt coordinated modifications to sensor measurements while remaining within plausible physiological ranges. Experiments conducted on the WUSTL-EHMS-2020 benchmark dataset demonstrate that the proposed framework achieves an F1-score of 94.3%, outperforming Isolation Forest and PCA Reconstruction by 34 percentage points. Furthermore, the proposed framework reduces the false alarm rate to 3.6%, compared with 35.1% and 9.2% achieved by Isolation Forest and PCA Reconstruction, respectively. These results demonstrate the effectiveness of the proposed framework for reliable detection of stealthy FDIAs in IoMT-based healthcare systems.<\/jats:p>","DOI":"10.3390\/bioengineering13080920","type":"journal-article","created":{"date-parts":[[2026,8,14]],"date-time":"2026-08-14T10:39:01Z","timestamp":1786703941000},"page":"920","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Patient-Specific Spatio-Temporal False Data Injection Attack Detection for IoMT Using a Graph-GRU Digital Twin and Kalman Innovation Features"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0412-7127","authenticated-orcid":false,"given":"Eman H.","family":"Alkhammash","sequence":"first","affiliation":[{"name":"Department of Computer Science, College of Computers and Information Technology, Taif University, Taif 21944, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1468-0655","authenticated-orcid":false,"given":"Fuad A.","family":"Ghaleb","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Birmingham City University, Birmingham B4 7XG, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2822-1708","authenticated-orcid":false,"given":"Faisal","family":"Saeed","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Birmingham City University, Birmingham B4 7XG, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6575-161X","authenticated-orcid":false,"given":"Sultan Noman","family":"Qasem","sequence":"additional","affiliation":[{"name":"Computer Science Department, College of Computer and Information Sciences, Imam Mohammad Ibn Saud Islamic University (IMSIU), Riyadh 11432, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,8,14]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"114","DOI":"10.1007\/s10462-024-11101-w","article-title":"A comprehensive and systematic literature review on intrusion detection systems in the internet of medical things: Current status, challenges, and opportunities","volume":"58","author":"Naghib","year":"2025","journal-title":"Artif. Intell. Rev."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"581","DOI":"10.1016\/j.future.2019.12.028","article-title":"Securing internet of medical things systems: Limitations, issues and recommendations","volume":"105","author":"Yaacoub","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Zachos, G., Mantas, G., Porfyrakis, K., and Rodriguez, J. (2025). Implementing Anomaly-Based Intrusion Detection for Resource-Constrained Devices in IoMT Networks. Sensors, 25.","DOI":"10.3390\/s25041216"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"100952","DOI":"10.1016\/j.iot.2023.100952","article-title":"A multi-objective mutation-based dynamic Harris Hawks optimization for botnet detection in IoT","volume":"24","author":"Gharehchopogh","year":"2023","journal-title":"Internet Things"},{"key":"ref_5","unstructured":"(2026, June 05). statista.com. Topics Internet Medical Things|statista.com. Available online: https:\/\/www.statista.com\/topics\/12748\/internet-of-medical-things-iomt."},{"key":"ref_6","unstructured":"Gupta, M. (2026, July 17). Global Internet of Things (IoT) Healthcare Market\u2013Industry Trends and Forecast to 2030. Available online: https:\/\/www.databridgemarketresearch.com\/reports\/global-internet-of-things-iot-healthcare-market."},{"key":"ref_7","unstructured":"Deb, T. (2026). Internet of Medical Things Statistics and Facts (2026), Market.us Media. Available online: https:\/\/media.market.us\/internet-of-medical-things-statistics\/."},{"key":"ref_8","first-page":"14","article-title":"A Systematic Review of Intrusion Detection Systems for Internet of Medical Things: Performance, Efficiency, Explainability, and Generalization","volume":"7","author":"Adohinzin","year":"2026","journal-title":"Digit. Threat."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"101631","DOI":"10.1016\/j.iot.2025.101631","article-title":"Evaluating and enhancing intrusion detection systems in IoMT: The importance of domain-specific datasets","volume":"32","author":"Siddiqui","year":"2025","journal-title":"Internet Things"},{"key":"ref_10","unstructured":"Hasan, M.M., Islam, R., and Hossain, M.Z. (2026). DSTAN-Med: Dual-Channel Spatiotemporal Attention with Physiological Plausibility Filtering for False Data Injection Attack Detection in IoT-Based Medical Devices. arXiv."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"2345","DOI":"10.1109\/JBHI.2023.3236072","article-title":"A Novel Experience-Driven and Federated Intelligent Threat-Defense Framework in IoMT","volume":"29","author":"Tahir","year":"2025","journal-title":"IEEE J. Biomed. Health Inform."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Sankepally, S.R., Kosaraju, N., Reddy, V., and Venkanna, U. (2022, January 14\u201316). Edge Intelligence Based Mitigation of False Data Injection Attack In IoMT Framework. Proceedings of the 2022 OITS International Conference on Information Technology (OCIT), Bhubaneswar, India.","DOI":"10.1109\/OCIT56763.2022.00085"},{"key":"ref_13","first-page":"48","article-title":"Distributed Attack Detection and Secure Estimation of Networked Cyber-Physical Systems Against False Data Injection Attacks and Jamming Attacks","volume":"4","author":"Guan","year":"2018","journal-title":"IEEE Trans. Signal Inf. Process. Over Netw."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"2338","DOI":"10.1109\/TCYB.2019.2915124","article-title":"Summation Detector for False Data-Injection Attack in Cyber-Physical Systems","volume":"50","author":"Ye","year":"2020","journal-title":"IEEE Trans. Cybern."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"174428","DOI":"10.1109\/ACCESS.2025.3618204","article-title":"Cyber-Resilient Smart Grids: A Randomized Coefficient-Based Defense Mechanism Against False Data Injection Attacks","volume":"13","author":"Shahid","year":"2025","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1121","DOI":"10.1109\/OJCS.2025.3585248","article-title":"A Comprehensive Survey on the Usage of Machine Learning to Detect False Data Injection Attacks in Smart Grids","volume":"6","author":"Nand","year":"2025","journal-title":"IEEE Open J. Comput. Soc."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Shees, A., Tariq, M., and Sarwat, A.I. (2024). Cybersecurity in Smart Grids: Detecting False Data Injection Attacks Utilizing Supervised Machine Learning Techniques. Energies, 17.","DOI":"10.3390\/en17235870"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"1287","DOI":"10.1109\/TAI.2023.3286831","article-title":"Robust Graph Autoencoder-Based Detection of False Data Injection Attacks Against Data Poisoning in Smart Grids","volume":"5","author":"Takiddin","year":"2024","journal-title":"IEEE Trans. Artif. Intell."},{"key":"ref_19","first-page":"2095","article-title":"Sparse Adversarial Learning for FDIA Attack Sample Generation in Distributed Smart Grids","volume":"139","author":"Li","year":"2024","journal-title":"CMES-Comput. Model. Eng. Sci."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/TII.2015.2475695","article-title":"Sparse Malicious False Data Injection Attacks and Defense Mechanisms in Smart Grids","volume":"11","author":"Hao","year":"2015","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Potluri, S., Diedrich, C., and Sangala, G.K.R. (2017, January 12\u201315). Identifying false data injection attacks in industrial control systems using artificial neural networks. Proceedings of the 2017 22nd IEEE International Conference on Emerging Technologies and Factory Automation (ETFA), Limassol, Cyprus.","DOI":"10.1109\/ETFA.2017.8247663"},{"key":"ref_22","unstructured":"Mo, Y., and Sinopoli, B. (2010, January 12). False data injection attacks in control systems. Proceedings of the Preprints of the 1st Workshop on Secure Control Systems, Stockholm, Sweden."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1568","DOI":"10.1109\/TCYB.2025.3534781","article-title":"Barycentric Coordinate-Based Distributed Localization for Wireless Sensor Networks Under False-Data-Injection Attacks","volume":"55","author":"Shi","year":"2025","journal-title":"IEEE Trans. Cybern."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Mo, Y., Garone, E., Casavola, A., and Sinopoli, B. (2010, January 15\u201317). False data injection attacks against state estimation in wireless sensor networks. Proceedings of the 49th IEEE Conference on Decision and Control (CDC), Atlanta, GA, USA.","DOI":"10.1109\/CDC.2010.5718158"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1145\/1952982.1952995","article-title":"False data injection attacks against state estimation in electric power grids","volume":"14","author":"Liu","year":"2011","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"70352","DOI":"10.1109\/ACCESS.2025.3563158","article-title":"Real-Time Anomaly Detection in IoMT Networks Using Stacking Model and a Healthcare-Specific Dataset","volume":"13","author":"Goumidi","year":"2025","journal-title":"IEEE Access"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"41994","DOI":"10.1109\/ACCESS.2025.3547572","article-title":"Anomaly-Based Intrusion Detection for IoMT Networks: Design, Implementation, Dataset Generation, and ML Algorithms Evaluation","volume":"13","author":"Zachos","year":"2025","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"425","DOI":"10.1016\/j.icte.2023.10.001","article-title":"SmartHealth: An intelligent framework to secure IoMT service applications using machine learning","volume":"10","author":"Rani","year":"2024","journal-title":"ICT Express"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1145\/3534577","article-title":"Combating False Data Injection Attacks on Human-Centric Sensing Applications","volume":"6","author":"Xin","year":"2022","journal-title":"Proc. ACM Interact. Mob. Wearable Ubiquitous Technol."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"45028","DOI":"10.1109\/ACCESS.2023.3273730","article-title":"Detection of False Data Injection Attacks in Smart Grid Based on Joint Dynamic and Static State Estimation","volume":"11","author":"Hu","year":"2023","journal-title":"IEEE Access"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"4529","DOI":"10.1109\/TAC.2022.3161259","article-title":"False Data Injection Attacks Against State Estimation Without Knowledge of Estimators","volume":"67","author":"Lu","year":"2022","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Qin, Y., Luo, Z., Che, Y., and Cao, L. (Green Energy Intell. Transp., 2026). False Data Injection Attacks Against UAV Battery State of Health Estimation with A Capacity-informed Latent Diffusion Model, Green Energy Intell. Transp., in press.","DOI":"10.1016\/j.geits.2026.100404"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"8873","DOI":"10.1109\/TII.2024.3374374","article-title":"Adversarial Artificial Intelligence in Blind False Data Injection in Smart Grid AC State Estimation","volume":"20","author":"Rahman","year":"2024","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"3992","DOI":"10.1109\/TSG.2023.3235945","article-title":"A False Data Injection Attack Detection Strategy for Unbalanced Distribution Networks State Estimation","volume":"14","author":"Wei","year":"2023","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"8467","DOI":"10.1109\/TII.2022.3149106","article-title":"Data-Driven Detection of Stealthy False Data Injection Attack Against Power System State Estimation","volume":"18","author":"Chen","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"7763","DOI":"10.1038\/s41598-026-37834-y","article-title":"Efficient detection of intrusions in TON-IoT dataset using hybrid feature selection approach","volume":"16","author":"Dharini","year":"2026","journal-title":"Sci. Rep."},{"key":"ref_37","unstructured":"Rai, P., and Sinha, D. (2024). False Data Injection Attack Detection Using Machine Learning in Industrial Internet of Things. Optimized Computational Intelligence Driven Decision-Making, IEEE."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Khan, L., and Kabir, F. (2024, January 14\u201316). In-depth Analysis on Secure and Privacy-Preserving Smart Care Homes based on Internet of Medical Things (IoMT). Proceedings of the 2024 IEEE International Conference on Interdisciplinary Approaches in Technology and Management for Social Innovation (IATMSI), Gwalior, India.","DOI":"10.1109\/IATMSI60426.2024.10503242"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Kondeti, V., and Bahsi, H. (2024, January 23\u201326). Mapping Cyber Attacks on the Internet of Medical Things: A Taxonomic Review. Proceedings of the 2024 19th Annual System of Systems Engineering Conference (SoSE), Tacoma, WA, USA.","DOI":"10.1109\/SOSE62659.2024.10620925"},{"key":"ref_40","first-page":"768","article-title":"A Layered Security Perspective on Internet of Medical Things: Challenges, Risks, and Technological Solutions","volume":"16","author":"Almulla","year":"2025","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"183339","DOI":"10.1109\/ACCESS.2019.2960617","article-title":"Security and Privacy for the Internet of Medical Things Enabled Healthcare Systems: A Survey","volume":"7","author":"Sun","year":"2019","journal-title":"IEEE Access"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Boo, Y.L., Stirling, D., Chi, L., Liu, L., Ong, K.-L., and Williams, G. (2018). False Data Injection Attacks in Healthcare. Data Mining, Singapore, Springer.","DOI":"10.1007\/978-981-13-0292-3"},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"e414","DOI":"10.7717\/peerj-cs.414","article-title":"A systematic review of security and privacy issues in the internet of medical things; the role of machine learning approaches","volume":"7","author":"Hameed","year":"2021","journal-title":"PeerJ Comput. Sci."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Alani, M.M., Mashatan, A., and Miri, A. (2023, January 14\u201317). Explainable Ensemble-Based Detection of Cyber Attacks on Internet of Medical Things. Proceedings of the 2023 IEEE International Conference on Dependable, Autonomic and Secure Computing, International Conference on Pervasive Intelligence and Computing, International Conference on Cloud and Big Data Computing, International Conference on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech), Abu Dhabi, United Arab Emirates.","DOI":"10.1109\/DASC\/PiCom\/CBDCom\/Cy59711.2023.10361448"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Badia, L., Bonagura, V., Pascucci, F., Vadori, V., and Grisan, E. (2024, January 8\u201311). Medical Self-Reporting with Adversarial Data Injection Modeled via Game Theory. Proceedings of the 2024 6th International Conference on Communications, Signal Processing, and Their Applications (ICCSPA), Istanbul, Turkiye.","DOI":"10.1109\/ICCSPA61559.2024.10794277"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"2215","DOI":"10.1109\/TNET.2020.3005549","article-title":"The Age of Incorrect Information: A New Performance Metric for Status Updates","volume":"28","author":"Maatouk","year":"2020","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"4862","DOI":"10.1109\/TSG.2022.3204796","article-title":"Detection of False Data Injection Attacks in Smart Grid: A Secure Federated Deep Learning Approach","volume":"13","author":"Li","year":"2022","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"1630","DOI":"10.1109\/TSG.2015.2495133","article-title":"A Review of False Data Injection Attacks Against Modern Power Systems","volume":"8","author":"Liang","year":"2017","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_49","unstructured":"Jain, R. (2026, July 08). WUSTL-EHMS-2020 Dataset. Washington University in St. Louis. Available online: https:\/\/www.cse.wustl.edu\/~jain\/ehms\/index.html."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"106576","DOI":"10.1109\/ACCESS.2020.3000421","article-title":"Intrusion Detection System for Healthcare Systems Using Medical and Network Data: A Comparison Study","volume":"8","author":"Hady","year":"2020","journal-title":"IEEE Access"},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"36523","DOI":"10.1007\/s11042-024-19916-z","article-title":"Towards robust and efficient intrusion detection in IoMT: A deep learning approach addressing data leakage and enhancing model generalizability","volume":"84","author":"Bouke","year":"2025","journal-title":"Multimed. Tools Appl."},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Nayak, J., Naik, B., S, V., and Favorskaya, M. (2024). Application of Deep Learning in Medical Cyber-Physical Systems. Machine Learning for Cyber Physical System: Advances and Challenges, Springer Nature.","DOI":"10.1007\/978-3-031-54038-7"},{"key":"ref_53","doi-asserted-by":"crossref","first-page":"344","DOI":"10.1016\/j.future.2022.10.021","article-title":"False data injection threats in active distribution systems: A comprehensive survey","volume":"140","author":"Husnoo","year":"2023","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_54","first-page":"102518","article-title":"Survey of false data injection in smart power grid: Attacks, countermeasures and challenges","volume":"54","author":"Aoufi","year":"2020","journal-title":"J. Inf. Secur. Appl."}],"container-title":["Bioengineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2306-5354\/13\/8\/920\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,14]],"date-time":"2026-08-14T10:58:55Z","timestamp":1786705135000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2306-5354\/13\/8\/920"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,14]]},"references-count":54,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2026,8]]}},"alternative-id":["bioengineering13080920"],"URL":"https:\/\/doi.org\/10.3390\/bioengineering13080920","relation":{},"ISSN":["2306-5354"],"issn-type":[{"value":"2306-5354","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,14]]}}}