用可解释的规则模型提升医疗物联网网络安全检测能力
A Tsetlin Machine-driven Intrusion Detection System for Next-Generation IoMT Security
- 基于可解释的命题逻辑规则模型，识别医疗设备网络攻击
- 二分类准确率达99.5%，多分类达90.7%，优于现有方法
- 提供投票得分与规则热力图，帮助理解决策依据
互联网医疗设备（IoMT）的快速普及正在重塑医疗系统，实现医疗设备、系统与服务的无缝连接。然而，这也带来了严重的网络安全与患者安全风险，攻击者正利用新方法和新兴漏洞入侵IoMT网络。本文提出一种基于强化学习型命题机（Tsetlin Machine, TM）的新型入侵检测系统（IDS），用于检测针对IoMT网络的多种网络攻击。该模型采用基于命题逻辑的规则化可解释机器学习方法，能有效建模攻击模式。在包含多种IoMT协议和攻击类型的CICIoMT-2024数据集上进行的大量实验表明，所提方法在二分类任务中达到99.5%的准确率，在多分类任务中达到90.7%的准确率，显著优于现有先进方法。此外，为增强模型可信度与可解释性，系统还提供了类别级投票分数和规则激活热力图，清晰揭示影响最终判断的关键规则及主导类别。
原文摘要 · Abstract (English)
The rapid adoption of the Internet of Medical Things (IoMT) is transforming healthcare by enabling seamless connectivity among medical devices, systems, and services. However, it also introduces serious cybersecurity and patient safety concerns as attackers increasingly exploit new methods and emerging vulnerabilities to infiltrate IoMT networks. This paper proposes a novel Tsetlin Machine (TM)-based Intrusion Detection System (IDS) for detecting a wide range of cyberattacks targeting IoMT networks. The TM is a rule-based and interpretable machine learning (ML) approach that models attack patterns using propositional logic. Extensive experiments conducted on the CICIoMT-2024 dataset, which includes multiple IoMT protocols and cyberattack types, demonstrate that the proposed TM-based IDS outperforms traditional ML classifiers. The proposed model achieves an accuracy of 99.5\% in binary classification and 90.7\% in multi-class classification, surpassing existing state-of-the-art approaches. Moreover, to enhance model trust and interpretability, the proposed TM-based model presents class-wise vote scores and clause activation heatmaps, providing clear insights into the most influential clauses and the dominant class contributing to the final model decision.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。