{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,29]],"date-time":"2026-09-29T19:24:06Z","timestamp":1790709846010,"version":"4.1.0"},"reference-count":20,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T00:00:00Z","timestamp":1781654400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Wireless Body Area Networks (WBANs) have become an essential component of modern Internet of Medical Things (IoMT) healthcare systems, enabling continuous monitoring of patient physiological signals through wearable sensors. Despite their advantages, WBAN environments remain highly prone to cyber threats, privacy breaches, and single points of failure. To address these risks, this work proposes a Hybrid Multi-Metric Anomaly Detection (HM-MAD) framework deployed on the NodeMCU-32S platform with BLE 5.0 connectivity for secure continuous glucose monitoring (CGM) data transmission. The detection model simultaneously analyses physiological signals, system-level parameters, and network-level communication metrics, enabling the reliable identification of multiple cyberattacks. The proposed system focuses on securing data transmission against relay attacks, where attackers induce communication delay without modifying payloads, potentially leading to false glucose readings, improper insulin dosage delivery, unauthorized control or denial-of-service. The Convolutional Neural Network (CNN) and Bi-Directional Long Short Term Memory (BiLSTM) model classifies attack types including timing manipulation, replay attacks, power glitches, firmware tampering, and sensor spoofing. Experimental evaluation demonstrates that the proposed CNN + BiLSTM framework achieves 94.6% detection accuracy with an average inference latency of 15 ms, representing a 50% latency reduction compared to Transformer-based intrusion detection models (30 ms), while simultaneously reducing computational overhead by 28% in terms of floating-point operations and memory utilization. These results indicate that the HM-MAD framework provides an effective and scalable solution for protecting resource-constrained IoMT healthcare systems against emerging cyber threats.<\/jats:p>","DOI":"10.3390\/s26123849","type":"journal-article","created":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T15:11:22Z","timestamp":1781709082000},"page":"3849","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["CNN-BiLSTM-Based Hybrid Deep Learning for Multi-Metric Anomaly Detection and Mitigation in Secure IoMT Healthcare WBANs"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1621-5220","authenticated-orcid":false,"given":"Shanmugaraj","family":"Muthupandian","sequence":"first","affiliation":[{"name":"Department of Electronics and Communication Engineering, Faculty of Engineering and Technology, SRM Institute of Science and Technology, Ramapuram Campus, Chennai 600089, Tamil Nadu, India"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9185-8560","authenticated-orcid":false,"given":"Devendran","family":"Manoj Kumar","sequence":"additional","affiliation":[{"name":"Department of Electronics and Communication Engineering, Faculty of Engineering and Technology, SRM Institute of Science and Technology, Ramapuram Campus, Chennai 600089, Tamil Nadu, India"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,6,17]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Mansour, M., Gamal, A., Ahmed, A., Said, L., Elbaz, A., Herencsar, N., and Soltan, A. (2023). Internet of Things: A comprehensive overview on protocols, architectures, technologies, simulation tools, and future directions. Energies, 16.","DOI":"10.3390\/en16083465"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"3035","DOI":"10.1021\/acs.jcim.5c00032","article-title":"Bidirectional long short-term memory (BiLSTM) neural networks with conjoint fingerprints: Application in predicting skin-sensitizing agents in natural compounds","volume":"65","author":"Duy","year":"2025","journal-title":"J. Chem. Inf. Model."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"eadl1856","DOI":"10.1126\/sciadv.adl1856","article-title":"Coin-sized, fully integrated, and minimally invasive continuous glucose monitoring system based on organic electrochemical transistors","volume":"10","author":"Bai","year":"2024","journal-title":"Sci. Adv."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"69","DOI":"10.1109\/LCA.2025.3544989","article-title":"Thor: A non-speculative value dependent timing side channel attack exploiting Intel AMX","volume":"24","author":"Dizani","year":"2025","journal-title":"IEEE Comput. Archit. Lett."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Li, Y., and Li, Z. (2023). Aye: A trusted forensic method for firmware tampering attacks. Symmetry, 15.","DOI":"10.3390\/sym15010145"},{"key":"ref_6","first-page":"6044071","article-title":"Machine learning methods to detect voltage glitch attacks on IoT\/IIoT infrastructures","volume":"2022","author":"Jiang","year":"2022","journal-title":"Comput. Intell. Neurosci."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"42000","DOI":"10.1109\/ACCESS.2022.3160047","article-title":"GNSS spoofing detection and mitigation in multireceiver configuration via tracklets and spoofer localization","volume":"10","author":"Pardhasaradhi","year":"2022","journal-title":"IEEE Access"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"2390","DOI":"10.1109\/TAC.2024.3476309","article-title":"Replay attack detection based on parity space method for cyber-physical systems","volume":"70","author":"Zhao","year":"2023","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"4745","DOI":"10.1109\/ACCESS.2023.3349287","article-title":"A survey of deep learning technologies for intrusion detection in Internet of Things","volume":"12","author":"Liao","year":"2024","journal-title":"IEEE Access"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Benaddi, H., Jouhari, M., Ibrahimi, K., Benslimane, A., and Amhoud, E.M. (2023). Improvement of anomaly detection system in IoT networks using CNN-LSTM approach. Proceedings of the IEEE Global Communications Conference (GLOBECOM), Kuala Lumpur, Malaysia, 4\u20138 December 2023, IEEE.","DOI":"10.1109\/GLOBECOM54140.2023.10437475"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"104747","DOI":"10.1016\/j.cose.2025.104747","article-title":"Internet of cybersecurity things in the third decade of the 21st century: A forward vision","volume":"161","author":"Rezk","year":"2026","journal-title":"Comput. Secur."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"438","DOI":"10.11591\/eei.v14i1.8377","article-title":"Distributed denial-of-service attack detection short review: Issues, challenges, and recommendations","volume":"14","author":"Habib","year":"2025","journal-title":"Bull. Electr. Eng. Inform."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"101420","DOI":"10.1016\/j.iot.2024.101420","article-title":"Ensuring patient safety in IoMT: A systematic literature review of behavior-based intrusion detection systems","volume":"28","author":"Mhiri","year":"2024","journal-title":"Internet Things"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"31039","DOI":"10.1038\/s41598-025-15292-2","article-title":"Hybrid deep learning-enabled framework for enhancing security, data integrity, and operational performance in healthcare Internet of Things (H-IoT) environments","volume":"15","author":"Naik","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Khan, M.N.U., Tang, Z., Cao, W., Abid, Y.A., Pan, W., and Ullah, A. (2023). Fuzzy-based efficient healthcare data collection and analysis mechanism using edge nodes in the IoMT. Sensors, 23.","DOI":"10.3390\/s23187799"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"124428","DOI":"10.1016\/j.eswa.2024.124428","article-title":"Intrusion detection and secure data storage in the cloud using a multiscale deep bidirectional gated recurrent neural network","volume":"255","author":"Preethi","year":"2024","journal-title":"Expert Syst. Appl."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"121975","DOI":"10.1109\/ACCESS.2021.3109886","article-title":"A review of security standards and frameworks for IoT-based smart environments","volume":"9","author":"Karie","year":"2021","journal-title":"IEEE Access"},{"key":"ref_18","first-page":"31","article-title":"A review of lightweight security and privacy for resource- constrained IoT devices","volume":"78","author":"Kumar","year":"2024","journal-title":"Comput. Mater. Contin."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Peng, H., Wu, C., and Xiao, Y. (2023). CBF-IDS: Addressing class imbalance using CNN-BiLSTM with focal loss in network intrusion detection system. Appl. Sci., 13.","DOI":"10.3390\/app132111629"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"100361","DOI":"10.1016\/j.snr.2025.100361","article-title":"A systematic review of continuous glucose monitoring sensors: Principles, core technologies and performance evaluation","volume":"10","author":"Wu","year":"2025","journal-title":"Sens. Actuators Rep."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/12\/3849\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,17]],"date-time":"2026-06-17T15:16:38Z","timestamp":1781709398000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/12\/3849"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,17]]},"references-count":20,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2026,6]]}},"alternative-id":["s26123849"],"URL":"https:\/\/doi.org\/10.3390\/s26123849","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,17]]}}}