Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments

AI 中文解读

医疗物联网设备联网后，安全问题一直让人头疼：设备种类杂、算力弱，还得实时分析数据。最近一项研究给出巧妙方案——像给数据“瘦身”一样，先剔除无关信息，再结合人工智能解释技术，从40个特征里只挑出5个关键特征来识别攻击。结果令人惊喜：准确率几乎不受影响，模型却轻便了88%，连普通医疗设备都能轻松跑起来。这项技术让入侵检测不再是“大算力专用”，未来医院里的智能监护仪、远程诊疗设备都能自带高效防护，在资源有限的环境下实时拦截恶意流量，保护患者隐私和设备安全。对普通人来说，这意味着更可靠的智慧医疗服务，也让我们离“无感却安心”的医疗物联网更近一步。

Internet of Medical Things (IoMT) networks are hard to protect: devices are heterogeneous, computing resources are scarce, and traffic must be analyzed in real time. We present an intrusion detection system that addresses these constraints through feature selection. A Pearson correlation filter first removes redundant attributes; a hybrid strategy then combines model-based feature importance with SHAP attribution to pick a compact subset, on which we train Random Forest and LightGBM classifiers. SHAP and LIME explain what each retained feature contributes to the decisions. On CIC-IoMT 2024 and CIC-IDS 2017, the method cuts the feature space by up to 88% - from 40 to as few as 5 features - and accuracy and F1-score stay within a few points of models trained on all features. Compact, interpretable detectors of this kind are practical candidates for deployment on resource-limited medical networks.