{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T16:16:50Z","timestamp":1790612210737,"version":"4.1.0"},"reference-count":32,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2026,4,18]],"date-time":"2026-04-18T00:00:00Z","timestamp":1776470400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The Internet of Medical Things (IoMT) is becoming a vital part of modern healthcare, enabling ongoing patient monitoring and remote diagnosis. However, as more devices connect to the internet, healthcare systems become more vulnerable to serious security issues such as unauthorized access, patient data manipulation, and Man-in-the-Middle attacks. Conventional Intrusion Detection Systems (IDSs) often struggle with the unclear and uncertain characteristics of IoMT traffic, which leads to reduced detection accuracy and increased false alarms. To address these challenges, this paper proposes ML-FSID-FIS, a multi-level feature selection-based Intrusion Detection System that employs a fuzzy inference system (FIS) for classification in IoMT networks. The model combines multiple feature selection techniques into a three-stage multi-level feature selection strategy to improve detection efficiency and strengthen the security of IoMT networks. In the first stage, four feature selection techniques\u2014Random Forest, XGBoost, ReliefF, and Mutual Information\u2014are applied to identify the most relevant features. In the second stage, a frequency-based consensus strategy is utilized to extract consistently selected features from the four top-ranked sets. In the third stage, an ensemble refinement using bagging-based ranking is employed to rank the remaining features, resulting in the selection of the top five features. From these, three candidate 3-feature groups are formed and evaluated, and the best-performing group is selected as the final input set for the fuzzy logic classifier. The FIS produces a continuous risk score that is mapped to a binary decision using a validation-selected threshold. When the proposed method was tested on the WUSTL-EHMS-2020 dataset and compared with other recent work using the same dataset, it showed strong detection performance while maintaining a very low false positive rate of 0.3%. This study is distinguished by its integrated design, which combines a three-stage multi-level feature selection strategy with fuzzy logic-based intrusion classification to improve feature efficiency and support interpretable intrusion detection in IoMT.<\/jats:p>","DOI":"10.3390\/s26082501","type":"journal-article","created":{"date-parts":[[2026,4,20]],"date-time":"2026-04-20T08:24:23Z","timestamp":1776673463000},"page":"2501","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["ML-FSID-FIS: A Multi-Level Feature Selection and Fuzzy Inference System for Intrusion Detection in IoMT"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-7471-2824","authenticated-orcid":false,"given":"Ghaida","family":"Balhareth","sequence":"first","affiliation":[{"name":"Department of Electrical Engineering & Computer Science, Florida Atlantic University, 777 Glades Road, Boca Raton, FL 33431, USA"},{"name":"Department of Information Systems, College of Computer Science and Information System, Najran University, Najran 61441, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mohammad","family":"Ilyas","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering & Computer Science, Florida Atlantic University, 777 Glades Road, Boca Raton, FL 33431, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7943-0510","authenticated-orcid":false,"given":"Basmh","family":"Alkanjr","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering & Computer Science, Florida Atlantic University, 777 Glades Road, Boca Raton, FL 33431, USA"},{"name":"Department of Computer Science, College of Computer and Information Science, Jouf University, Sakaka 72388, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,4,18]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"10125","DOI":"10.1109\/TII.2022.3231424","article-title":"A secure ensemble learning-based fog-cloud approach for cyberattack detection in IoMT","volume":"19","author":"Khan","year":"2023","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Ali, A., Al-Rimy, B.A.S., Alsubaei, F.S., Almazroi, A.A., and Almazroi, A.A. (2023). HealthLock: Blockchain-Based Privacy Preservation Using Homomorphic Encryption in Internet of Things Healthcare Applications. Sensors, 23.","DOI":"10.3390\/s23156762"},{"key":"ref_3","unstructured":"Grand View Research (2025, November 14). Internet of Medical Things (IoMT) Market To Reach $658.57 Billion by 2030. Available online: https:\/\/www.grandviewresearch.com\/press-release\/global-internet-of-medical-things-iomt-market."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"110227","DOI":"10.1016\/j.asoc.2023.110227","article-title":"Survey of Machine Learning based intrusion detection methods for Internet of Medical Things","volume":"140","author":"Boustia","year":"2023","journal-title":"Appl. Soft Comput."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Alani, M.M. (2014). Tcp\/ip model. Guide to OSI and TCP\/IP Models, Springer.","DOI":"10.1007\/978-3-319-05152-9"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"103","DOI":"10.1109\/91.493904","article-title":"Fuzzy logic = computing with words","volume":"4","author":"Zadeh","year":"1996","journal-title":"IEEE Trans. Fuzzy Syst."},{"key":"ref_7","unstructured":"Terano, T., Asai, K., and Sugeno, M. (1992). Fuzzy Systems Theory and Its Applications, Professional, Inc."},{"key":"ref_8","first-page":"43","article-title":"AI for IoMT Security: A Survey of Intrusion Detection Systems, Architectures, Attacks and Challenges","volume":"15","author":"Ilyas","year":"2024","journal-title":"Int. J. Artif. Intell. Appl. (IJAIA)"},{"key":"ref_9","unstructured":"Alani, M.M., Mashatan, A., and Miri, A. (2023, January 4\u201310). XMeDNN: An Explainable Deep Neural Network System for Intrusion Detection in Internet of Medical Things. Proceedings of the ICISSP, Rhodes Island, Greece."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"25454","DOI":"10.1109\/JIOT.2023.3327024","article-title":"An intelligent and explainable SaaS-based intrusion detection system for resource-constrained IoMT","volume":"11","author":"Aljuhani","year":"2023","journal-title":"IEEE INternet Things J."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"108158","DOI":"10.1016\/j.compeleceng.2022.108158","article-title":"A tree classifier based network intrusion detection model for Internet of Medical Things","volume":"102","author":"Gupta","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"100056","DOI":"10.1016\/j.fraope.2023.100056","article-title":"Optimized machine learning enabled intrusion detection 2 system for internet of medical things","volume":"6","author":"Sun","year":"2024","journal-title":"Frankl. Open"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"102659","DOI":"10.1016\/j.rineng.2024.102659","article-title":"An RFE\/Ridge-ML\/DL based anomaly intrusion detection approach for securing IoMT system","volume":"23","author":"Lazrek","year":"2024","journal-title":"Results Eng."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Alalhareth, M., and Hong, S.C. (2024). Enhancing the internet of medical things (IoMT) security with meta-learning: A performance-driven approach for ensemble intrusion detection systems. Sensors, 24.","DOI":"10.3390\/s24113519"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Alani, M.M., Mashatan, A., and Miri, A. (2023). Explainable ensemble-based detection of cyber attacks on internet of medical things. 2023 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech), IEEE.","DOI":"10.1109\/DASC\/PiCom\/CBDCom\/Cy59711.2023.10361448"},{"key":"ref_16","first-page":"1853","article-title":"Priority Detector and Classifier Techniques Based on ML for the IoMT","volume":"76","author":"Alsemmeari","year":"2023","journal-title":"Comput. Mater. Contin."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"23080","DOI":"10.1109\/JIOT.2024.3387294","article-title":"Meta-IDS: Meta-learning-based smart intrusion detection system for Internet of Medical Things (IoMT) network","volume":"11","author":"Zukaib","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/IOTM.001.2300021","article-title":"Deep learning-based network intrusion detection system for Internet of medical things","volume":"6","author":"Ravi","year":"2023","journal-title":"IEEE Internet Things Mag."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"8395","DOI":"10.1109\/JIOT.2022.3230694","article-title":"A novel intrusion detection system for internet of healthcare things based on deep subclasses dispersion information","volume":"10","author":"Fouda","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"2049","DOI":"10.1109\/TCE.2024.3350231","article-title":"A blended deep learning intrusion detection framework for consumable edge-centric iomt industry","volume":"70","author":"Alzubi","year":"2024","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Balhareth, G., and Ilyas, M. (2024). Optimized Intrusion Detection for IoMT Networks with Tree-Based Machine Learning and Filter-Based Feature Selection. Sensors, 24.","DOI":"10.3390\/s24175712"},{"key":"ref_22","unstructured":"Arun, V., Shenbagavalli, P., Sridhar, T., Manivannan, B., Mahesh, T., and Anitha, K. (2023). Machine Learning Algorithms for the Detection of Threats in IoT Healthcare. 2023 International Conference on Emerging Research in Computational Science (ICERCS), IEEE."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Alserhani, F., and Aljared, A. (2023). Evaluating Ensemble Learning Mechanisms for Predicting Advanced Cyber Attacks. Appl. Sci., 13.","DOI":"10.3390\/app132413310"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1007\/s44196-023-00205-w","article-title":"A multi-level random forest model-based intrusion detection using fuzzy inference system for internet of things networks","volume":"16","author":"Awotunde","year":"2023","journal-title":"Int. J. Comput. Intell. Syst."},{"key":"ref_25","unstructured":"Sundhari, S.S. (2011). A knowledge discovery using decision tree by Gini coefficient. 2011 International Conference on Business, Engineering and Industrial Applications, IEEE."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Chen, T., and Guestrin, C. (2016, January 13\u201317). Xgboost: A scalable tree boosting system. Proceedings of the 22nd ACM Sigkdd International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA.","DOI":"10.1145\/2939672.2939785"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1186\/s13040-024-00390-0","article-title":"Assessing the limitations of relief-based algorithms in detecting higher-order interactions","volume":"17","author":"Freda","year":"2024","journal-title":"Biodata Min."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Campos, R., Canuto, S., Salles, T., de S\u00e1, C.C., and Gon\u00e7alves, M.A. (2017, January 7\u201311). Stacking bagged and boosted forests for effective automated classification. Proceedings of the 40th International ACM SIGIR Conference on Research and Development in Information Retrieval, Tokyo, Japan.","DOI":"10.1145\/3077136.3080815"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"3147","DOI":"10.1007\/s12665-013-2702-7","article-title":"A comparative study of artificial neural networks, Bayesian neural networks and adaptive neuro-fuzzy inference system in groundwater level prediction","volume":"71","author":"Maiti","year":"2014","journal-title":"Environ. Earth Sci."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Dorzhigulov, A., and James, A.P. (2019). Generalized bell-shaped membership function generation circuit for memristive neural networks. 2019 IEEE International Symposium on Circuits and Systems (ISCAS), IEEE.","DOI":"10.1109\/ISCAS.2019.8702214"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"24141","DOI":"10.48084\/etasr.10852","article-title":"An IDS-based Adaptive Neural Fuzzy Inference System (ANFIS) for IoBT Security Utilizing Particle Swarm Optimization","volume":"15","author":"Alkanjr","year":"2025","journal-title":"Eng. Technol.Appl. Sci. Res."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1016\/j.aasri.2013.10.058","article-title":"False alarm detection in cyber-physical systems for healthcare applications","volume":"5","author":"Haque","year":"2013","journal-title":"Aasri Procedia"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/8\/2501\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,20]],"date-time":"2026-04-20T08:38:21Z","timestamp":1776674301000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/8\/2501"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,18]]},"references-count":32,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2026,4]]}},"alternative-id":["s26082501"],"URL":"https:\/\/doi.org\/10.3390\/s26082501","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,18]]}}}