{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T16:55:49Z","timestamp":1790614549000,"version":"4.1.0"},"reference-count":25,"publisher":"MDPI AG","issue":"19","license":[{"start":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T00:00:00Z","timestamp":1790294400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>The Internet of Medical Things (IoMT) environment is based on WiFi and MQTT communication, which results in highly imbalanced intrusion-detection data with a high degree of heterogeneity. In this study, XGB-AGMoE is proposed, a validation-adaptive XGBoost-anchored Granular Mixture-of-Experts framework that combines the quantile-derived granular descriptors and experts of CatBoost, LightGBM, XGBoost, class-wise post hoc sigmoid calibration, leakage-free logistic-regression stacking, and an XGBoost-anchored probability fusion stage. The official test partition was set aside for final evaluation after disjoint development subsets were used for preprocessing, calibration, stacking, and anchor selection. The value of 0.80 was chosen for the anchor weight for the calibrated XGBoost, and 0.20 was chosen for the calibrated stack for the canonical seed-42 experiment. The resulting model achieved 0.993887 accuracy, 0.993681 weighted-F1, 0.851256 macro-F1, 0.999634 macro-ROC-AUC, and 0.921352 macro-PR-AUC on a 150,000-record official test sample. The Brier score, negative log-likelihood, and expected calibration error were 0.007531, 0.015309, and 0.001775, respectively. Across seeds 42, 52, and 62, accuracy was 0.9926\u00b10.0012 and macro-F1 was 0.8238\u00b10.0251. Recall was higher for the top denial of service classes and lower for DDoS Publish Flood and Recon VulScan. The results corroborate with expert anchoring and validation-controlled evaluation; they also highlight that there are fusion gains that depend on the data split and that they should be evaluated in the light of robust component baselines.<\/jats:p>","DOI":"10.3390\/s26196096","type":"journal-article","created":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T14:36:34Z","timestamp":1790346994000},"page":"6096","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["XGB-AGMoE: A Validation-Adaptive XGBoost-Anchored Granular Mixture-of-Experts Framework for Multi-Class Intrusion Detection in IoMT WiFi\u2013MQTT Traffic"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5198-5730","authenticated-orcid":false,"given":"Madallah","family":"Alruwaili","sequence":"first","affiliation":[{"name":"Department of Computer Engineering and Networks, College of Computer and Information Sciences, Jouf University, Sakaka 72388, Aljouf, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"data-curation","vocabulary":"credit"},{"role":"project-administration","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0941-9855","authenticated-orcid":false,"given":"Fawaz J.","family":"Alruwaili","sequence":"additional","affiliation":[{"name":"Department of Computer Science, College of Computer and Information Sciences, Jouf University, Sakaka 72388, Aljouf, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"methodology","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"data-curation","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9658-0972","authenticated-orcid":false,"given":"Mahmood","family":"Mohamed","sequence":"additional","affiliation":[{"name":"Information Systems & Technology Department, Faculty of Graduate Studies for Statistical Research, Cairo University, Giza 12613, Egypt"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"resources","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,25]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-BaIoT\u2014Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Ashraf, J., Raza, G.M., Kim, B.-S., Wahid, A., and Kim, H.-Y. (2025). Making a Real-Time IoT Network Intrusion-Detection System (INIDS) Using a Realistic BoT\u2013IoT Dataset with Multiple Machine-Learning Classifiers. Appl. Sci., 15.","DOI":"10.3390\/app15042043"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","article-title":"TON_IoT Telemetry Dataset: A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems","volume":"8","author":"Alsaedi","year":"2020","journal-title":"IEEE Access"},{"key":"ref_4","unstructured":"Sharma, B., Kumar, R., Kumar, A., Chhabra, M., and Chaturvedi, S. (2023, January 15\u201317). A Systematic Review of IoT Malware Detection Using Machine Learning. Proceedings of the 2023 10th International Conference on Computing for Sustainable Global Development (INDIACom), New Delhi, India."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"147","DOI":"10.1016\/j.cose.2019.06.005","article-title":"A Survey of Network-Based Intrusion Detection Data Sets","volume":"86","author":"Ring","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_6","first-page":"102419","article-title":"Deep Learning for Cyber Security Intrusion Detection: Approaches, Datasets, and Comparative Study","volume":"50","author":"Ferrag","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1186\/s42400-019-0038-7","article-title":"Survey of Intrusion Detection Systems: Techniques, Datasets and Challenges","volume":"2","author":"Khraisat","year":"2019","journal-title":"Cybersecurity"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Doshi, R., Apthorpe, N., and Feamster, N. (2018, January 24). Machine Learning DDoS Detection for Consumer Internet of Things Devices. Proceedings of the 2018 IEEE Security and Privacy Workshops (SPW), San Francisco, CA, USA.","DOI":"10.1109\/SPW.2018.00013"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Chen, T., and Guestrin, C. (2016, January 13\u201317). XGBoost: A Scalable Tree Boosting System. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD \u201916), New York, NY, USA.","DOI":"10.1145\/2939672.2939785"},{"key":"ref_10","unstructured":"Ke, G., Meng, Q., Finley, T., Wang, W., Chen, W., Ma, W., Ye, Q., and Liu, T.-Y. (2017, January 4\u20139). LightGBM: A Highly Efficient Gradient Boosting Decision Tree. Proceedings of the 31st International Conference on Neural Information Processing Systems (NIPS\u201917), Red Hook, NY, USA."},{"key":"ref_11","unstructured":"Prokhorenkova, L., Gusev, G., Vorobev, A., Dorogush, A.V., and Gulin, A. (2018, January 2\u20138). CatBoost: Unbiased Boosting with Categorical Features. Proceedings of the 32nd International Conference on Neural Information Processing Systems (NIPS\u201918), Red Hook, NY, USA."},{"key":"ref_12","first-page":"93","article-title":"Ensemble Machine Learning Approach for IoT Intrusion Detection Systems","volume":"49","author":"Hammood","year":"2023","journal-title":"Iraqi J. Comput. Inform."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"230","DOI":"10.12688\/f1000research.161643.1","article-title":"Artificial Intelligence Model for Internet of Things Attack Detection Using Machine Learning Algorithms","volume":"14","author":"Abebe","year":"2025","journal-title":"F1000Research"},{"key":"ref_14","unstructured":"Platt, J. (2000). Probabilistic Outputs for Support Vector Machines and Comparisons to Regularized Likelihood Methods. Advances in Large Margin Classifiers, MIT Press."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Zadrozny, B., and Elkan, C. (2002, January 23\u201326). Transforming Classifier Scores into Accurate Multiclass Probability Estimates. Proceedings of the Eighth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD\u201902), New York, NY, USA.","DOI":"10.1145\/775047.775151"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Niculescu-Mizil, A., and Caruana, R. (2005, January 7\u201311). Predicting Good Probabilities with Supervised Learning. Proceedings of the 22nd International Conference on Machine Learning (ICML \u201905), New York, NY, USA.","DOI":"10.1145\/1102351.1102430"},{"key":"ref_17","first-page":"1321","article-title":"On Calibration of Modern Neural Networks","volume":"Volume 70","author":"Guo","year":"2017","journal-title":"Proceedings of the 34th International Conference on Machine Learning"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"241","DOI":"10.1016\/S0893-6080(05)80023-1","article-title":"Stacked Generalization","volume":"5","author":"Wolpert","year":"1992","journal-title":"Neural Netw."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1162\/neco.1991.3.1.79","article-title":"Adaptive Mixtures of Local Experts","volume":"3","author":"Jacobs","year":"1991","journal-title":"Neural Comput."},{"key":"ref_20","unstructured":"Pedrycz, W. (2016). Granular Computing: Analysis and Design of Intelligent Systems, CRC Press."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Peters, J.F., Skowron, A., Grzyma\u0142a-Busse, J.W., Kostek, B., \u0141winiarski, R.W., and Szczuka, M.S. (2004). A Partition Model of Granular Computing. Transactions on Rough Sets I, Springer. Lecture Notes in Computer Science.","DOI":"10.1007\/b98175"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"101351","DOI":"10.1016\/j.iot.2024.101351","article-title":"CICIoMT2024: Attack Vectors in Healthcare Devices\u2014A Multi-Protocol Dataset for Assessing IoMT Device Security","volume":"28","author":"Dadkhah","year":"2024","journal-title":"Internet Things"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"2097","DOI":"10.1038\/s41598-025-31897-z","article-title":"A Novel Adaptive Hybrid Intrusion Detection System with Lightweight Optimization for Enhanced Security in Internet of Medical Things","volume":"16","author":"Saeed","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Ur Rehman, M., Kalakoti, R., and Bahsi, H. (2025, January 20\u201322). Comprehensive Feature Selection for Machine Learning-Based Intrusion Detection in Healthcare IoMT Networks. Proceedings of the 11th International Conference on Information Systems Security and Privacy, Porto, Portugal.","DOI":"10.5220\/0013313600003899"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Mejdoub, Y., Elamri, A., and Kardouchi, M. (2026). Enhancing IoMT Security with Explainable Machine Learning: A Case Study on the CICIoMT2024 Dataset. Connected Objects, Artificial Intelligence, Telecommunications and Electronics Engineering. COCIA 2025, Springer. Lecture Notes in Networks and Systems.","DOI":"10.1007\/978-3-032-01536-5"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6096\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T15:58:58Z","timestamp":1790611138000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6096"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,25]]},"references-count":25,"journal-issue":{"issue":"19","published-online":{"date-parts":[[2026,10]]}},"alternative-id":["s26196096"],"URL":"https:\/\/doi.org\/10.3390\/s26196096","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,25]]}}}