A Deep Learning and Blockchain-Based Trust Framework for Securing IoMT

Managed medical information collected from different patient sensors is sensitive and has to be secured against attacks. New technologies such as cloud architecture are used by doctors to guarantee data availability by storing duplicate data continuously. In fact, these new technologies are also subject to attacks targeting the medical sensitive data. Therefore, administrators deploy recent intrusion detection approaches based on deep learning (DL) algorithms that are developed by researchers. In this field, Khatun et al. [7] gave a fundamental overview of IoT in healthcare. They presented privacy and data security challenges associated with machine learning (ML) and healthcare IoT (H-IoT) devices. Moreover, they focused on monitoring IoT layers in this domain, such as network, perception, and cloud. This study examines the key aspects of cybersecurity, big data, e-health, and cloud computing in the context of H-IoT. It explores the application of ML techniques, including anomaly detection, device classification, and their critical and access control.

To trust the deployed system, several security requirements in the medical field have to be ensured, regarding the recorded data in the database and its transfer between patients and medical staff. To meet these challenges, some works [10] propose a reputation system deployment. Other works [11, 12] build trust using AI, whereas other works implemented blockchain-based health data.

2.1 Centralized trust-based approaches

We notice that some researchers focus on the trust of communications in different areas. In fact, Umashankar Ghugar et al. [13] presented an approach called Dual-Layer Trust Based IDS (DLTIDS). It is based on trust to counter Blackhole attacks, where two layers of defense are deployed. The first layer is about the evaluation of the behavior of the nodes thanks to the packet transfer rate, the calculations of trust, and the reliability at the level of communications. The second layer is based on the improvement of security via the indirect measures of trust. Remya et al. [14] developed a system called Trust-Based IDS for RPL (TIDSRPL). They aimed to decrease the risk of resource exhaustion via this strategic transfer that conserves energy, computing resources, and storage at the node level. It uses a hybrid trust model and heartbeat monitoring, offloading complex computations to the root node. It employs Subjective Logic, incorporating trust, distrust, and uncertainty for flexible attack detection. Key parameters include trust propagation and Fault Threshold to reduce false positives. It outperforms the default objective function, Minimum Rank with Hysteresis Objective Function-RPL (MRHOF-RPL), with a 33-45% improvement in energy efficiency and a 20-35% reduction in packet loss. It offers 45% better energy conservation during combined Selective Forwarding and Sinkhole attacks.

These works present IDS implementation, but they consider trust as a metric in the intrusion detection process. Added to that, the proposed system is centralized, so it is exposed to vulnerabilities and integrity attacks.

2.2 Blockchain-based trust approaches

To mitigate the centralization threats, several works adopted the decentralized blockchain technology. Indeed, Yang et al. [10] proposed a secure and efficient blockchain-based data sharing scheme for IoT. This system is based on an off-chain storage strategy and then performs on-chain indexing to meet the storage constraints in the blockchain, and uses a specific smart contract for the purpose of access control, secure querying, and sharing of data in IoT. At the data sharing process level, they incorporate a reputation mechanism. In addition, in this work, the system calculates the reputation of nodes and stores them in the blockchain via a smart contract. Any user announced as malicious is revoked.

To protect the HSN, Mutleg et al. [5] suggested a solution using Hyperledger blockchain to detect compromised Internet of Medical Things (IoMT) nodes and protect sensitive health information. They introduced a Clustered Hierarchical Trust Management System (CHTMS) designed to block malicious nodes. For securing health records, they use an embedded Elliptic Curve Cryptography (ECC), and they are interested in resistance against Denial of Service (DoS) attacks. About evaluation results, they indicate that integrating blockchain into the HSN enhances detection capabilities and outperforms current systems, demonstrating improved security and reliability compared to traditional databases. Bhan et al. [15] propose a Federated Friendly Learning (FCL) platform to ensure privacy in IoMT applications and secure data sharing. This study proposed a secure and collaborative federated Q-learning model, integrating a blockchain-certified trust mechanism, which strengthens data privacy by restricting participation to only authenticated nodes. This architecture is based on a multi-layer model combining (1) a blockchain infrastructure, (2) a dynamic trust mechanism, (3) a federated learning framework and (4) secure communication protocols. Regarding the results of this work, there is an increase in the accuracy levels equal to 94.7% and privacy protection equal to 92.4%.

Another use of the blockchain is proposed by Babu et al. [16]. They deploy blockchain technology to protect the confidentiality of patient information and to secure data exchange. Trust is guaranteed by smart contracts based on keys and certificates. The chain codes manage actors’ authentication, registration, and verification. This also ensures chain traceability.

2.3 Intrusion detection-based approaches

In the related works on ML-enabled IDS for IoMT, a variety of innovative methodologies have been explored to improve feature selection and classification processes. The work presented by Ibrahim et al. [2] is based on a robust IDS for IoMT networks. It integrates a honeypot to divert attackers from critical systems and uses ML (K-Nearest Neighbor) to improve detection accuracy and resilience against cyberattacks. Researchers evaluated their models by testing two IoMT datasets, containing attacks such as Man-In-The-Middle (MITM), Data Injection, and Distributed Denial of Service (DDoS). The results are 92.5% and 99.54% for accuracy and 96.74% and 99.23% for precision across all datasets, highlighting the potential of IDS to secure IoMT networks. In the same field, Sudharson et al. [17] implemented ML-IDS to increase the security of smart health applications (medical IoT) and patient information in the interconnected world. They used AdaBoost classifier, giving a recall value of 0.96. Their approach, tested on NSL-KDD dataset, focused on 12 features to achieve high performance in detecting DoS, User-to-Root (U2R), Root-to-Local (R2L), and Probe attacks. This system demonstrated superior accuracy, recall, and precision metrics. The study highlights the effectiveness of using adaptive ML models and optimized feature selection to enhance the security of interconnected medical devices, providing critical insights into the development of robust IoMT security frameworks.

Table 1. Comparison of the studied related work

Tyagi and Manju Bargavi [18] introduced a blockchain-based approach in their study, where they proposed a method called FIDANN, which is an intelligent intrusion detection mechanism. This method protects the confidentiality of medical information using Artificial Neural Networks (ANN) optimized by Dwarf Mongoose and uses a Federated Learning technique. This work used blockchain technology to save the updated model’s weights. Thus, they guarantee integrity in a decentralized system. Actually, Kanna et al. [9] proposed an approach based on DL to secure medical information. In this work, the data acquisition phase is done via online sources and then verified by the weight function (WO-DBN: Weight-Optimized Deep Belief Network). Regarding the security of medical data, the authors base their approach on chaotic map assisted encryption coupled with the optimal key generation of existing images in the database and blockchain technology. The final phase is about disease diagnosis, where the decrypted data are sent to classify the node with or without malicious intrusion. This phase is done via Res-LSTM + DNN: the support of a residual network (Resnet101), Long Short-Term Memory (LSTM), and the Deep Neural Network (DNN). In the validation part of this work, the accuracy rate of the approach is 98.6%. Another approach named SNN-IoMT (Stacked Neural Network Ensemble for IoMT Security) was proposed by Sun et al. [19]. It consists of an AI-based IDS framework designed to secure dynamic IoMT environments. This article is based on a DL architecture of STM, MLP (stacked combining multi-layer perceptron), and Convolutional Neural Network (CNN). It presents a model for optimizing data management and integration while ensuring system scalability and interoperability. The experiments are based on both IoTHealthcare-Security and WUSTL-EHMS-2020 datasets, providing respectively 99.95% and 99.65% accuracy.

Although the trust-based IDS demonstrates robust energy efficiency and enhanced security against various routing attacks, it is not without limitations. One notable challenge is its reliance on offloading computational tasks to the root node in high traffic scenarios. Furthermore, the effectiveness of the system depends on fine-tuning parameters, such as trust thresholds and Fault Threshold values, which may vary across network environments and require context-specific optimization. Moreover, as presented in Table 1, to ensure traceability, blockchain technology is used without focusing on IDS output, which may detect an attack that is not considered in the blockchain update, which is essential in the medical environment using sensitive data.

The simulation environment is a Virtual machine with the operating system Ubuntu 20.04. The virtual material of the virtual machine is: 8 vCPU and 16 GB of RAM. In the following, we will describe the evaluation of each part of our system.

4.1 AI-based IDS

4.1.1 Dataset description

We trained and tested our model on the CIC-IoMT2024 dataset [23]. This dataset is produced in a real environment with a miscellaneous type of sensors (healthcare sensors, home devices…) established by the Canadian Institute for Cybersecurity. Also, different protocols are used in the collected data, such as Bluetooth and Wi-Fi. The collected traffic contains benign and malicious flows. Malicious traffic contains mainly five attack families: recon, spoofing, DoS, DDoS, and malformed data.

We propose to deploy our IDS on this dataset. We have chosen to perform different classifications as Table 3 details. The benign and the recon traffic contain varied protocols. The Denial-of-Service Traffic was parsed into either MQTT or TCP/IP protocol.

Table 3. Selected dataset description

tu_pian_12.png

Figure 6. Class distribution in training dataset

The proposed dataset separates training data from test data. Thus, we trained our model on the training dataset, and then the test phase uses the provided test dataset. Our model is executed on the train files provided by the Canadian Institute for Cybersecurity. We split the file into 70% train and 30% validation. Then, to evaluate our model, we test it on the offered test files. The distribution of different classes’ instances in the provided train data is illustrated in Figure 6.

4.1.2 Evaluation metrics

To evaluate a model, numerous metrics exist apart from accuracy. To extend our approach study, we focus on: confusion matrix (CM), precision, recall, and F1-score [24, 25].

Confusion matrix (CM): In the CM: Rows, reflect actual classes marked True and False. As for columns, they present predicted values. If the prediction is correct, it is considered Positive. Otherwise, it is Negative. This matrix is summarized in Eq. (5).

$\mathrm{CM}=\begin{array}{ll}T P & F P \\ F N & T N\end{array}$               (5)

where,

TP: True Positive: information correctly detected as attack.

FP: False Positive: incorrectly detected benign as attack.

FN: False Negative: incorrectly classified attacks as benign.

TN: True Negative: benign information correctly classified.

Accuracy (ACC): The Accuracy metric is measured by the proportion of correctly classified observations (both TP and TN) out of the total observations. This metric is represented by Eq. (6).

$ACC=\frac{\left( TN+TP \right)}{\left( TN+TP+FP+FN \right)}$             (6)

Precision: This metric considers the samples classified as positive. It presents the correctly classified positive samples percentage to both TP and FP. This metric is presented by Eq. (7).

$Precision~=\frac{TP}{TP+FP}$              (7)

Recall: It evaluates the effectiveness of a model to correctly identify all labels. It is presented by Eq. (8).

$Recall~=\frac{TP}{TP~+FN~}$            (8)

F1-score: The F1-score is the average of the precision presented by Eq. (7) and the recall obtained by Eq. (8). This parameter provides a balance between recall and precision. It is detailed in Eq. (9).

$F 1-$ Score $=2 * \frac{\text { Precision } * \text { Recall }}{\text { Precision }+ \text { Recall }}$            (9)

4.1.3 Model results

After selecting the dataset, we initiated the learning process through creating the DL model described earlier, based on CNN. We trained and tested the model using three different class distributions, detailed in Figure 7 alongside other existing distributions. The first distribution is Boolean, classifying traffic as either benign or DoS. The second includes an additional attack type: reconnaissance (recon). The third distribution treats each category separately, encompassing 19 classes in total—benign plus 18 distinct attack types. Due to the large size of the dataset and limitations of our hardware, we reduced the amount of data related to DoS and DDoS attacks during training.

tu_pian_13.png

Figure 7. Different proposed distributions

In the 2-class and 3-class classification scenarios, accuracy exceeds 99%, achieving 99.6% and 99%, respectively. However, in the 19-class classification, accuracy drops to 73%. To better understand these results, we analyzed the confusion matrices shown in Figures 8, 9 and 10. In the binary classification, the number of false positives (FP) and false negatives (FN) remain very low relative to the overall traffic.

In the multi-class setting, confusion occurs primarily between benign traffic and both ARP spoofing and reconnaissance attacks. This is due to certain features that are not sufficiently discriminative for these classes but are important for distinguishing DoS attacks. Moreover, these types of attacks do not alter the system’s state, making them harder to detect [25]. Additional confusion is observed within the DoS traffic, particularly between TCP-IP and MQTT traffic, as they exhibit similar behaviors.

tu_pian_14.png

(a) Benign and DoS

tu_pian_15.png

(b) Benign and attack

Figure 8. 2 Classes' confusion matrix

tu_pian_16.png

Figure 9. Confusion matrix for 3 classes’ classification

tu_pian_17.png

Figure 10. Confusion matrix for 19 classes

4.1.4 Comparison of classification results

Table 4 summarizes classification results across different studies, which mainly follow two common class distributions. The first is a binary classification setting, where [21, 26, 27] categorize data into benign and attack classes, achieving accuracies of 99.6%, 97%, and 99.92%, respectively. Our model outperforms accuracies reported in the previous studies [21, 26], while remaining consistent with the study by Hafid et al. [27]. The second setting involves a 19-class distribution, used in the previous studies [21, 26], where they achieved accuracies of 73.3% and 87.96%, respectively. Our model attains comparable accuracy to the study by Fourati et al. [21]; however, Mezina et al. [26] reported superior results due to their use of a hybrid model that incorporates deeper and more complex learning architectures. In contrast, we introduced a novel 3-class distribution with a different class split. Using our CNN model under this setup, we achieved an accuracy of 99%, a Recall of 95.21%, a Precision of 94.77%, and an F1-score of 94.77%. The relatively lower F1-score can be attributed to class imbalance within the training dataset.

Table 4. Comparative results

4.2 Blockchain configuration

The chosen blockchain network is the permissioned blockchain GoQuorum. It represents an open-source Ethereum-based blockchain. This blockchain is a real blockchain that can be implemented in a production environment. It proposes different consensus algorithms: Raft, IBFT, and QBFT. The selected consensus algorithm is RAFT, as it offers rapidity. After the installation of Geth (Go Ethereum) proposed by GoQuorum, we proceeded with the creation of the blockchain network, specifying the initial node’s number and the consensus algorithm. Our GoQuorum blockchain network is formed by 5 nodes using the Raft consensus algorithm. A node is defined by an IP address and a port where the service is running.

We prepared the script of our smart contract and then compiled it. As a result, we have the ABI and the bytecode distinguishing the contract. We then deployed our smart contract to the blockchain network using the Ethereum library web3 via the Application Programming Interface (API) JSON-RPC [28]. This API allows our program to make calls with the Ethereum client. Once the contract is deployed, a contract address is generated to identify our contract and make interaction with it possible. This is a primordial action so that our nodes update the trust level. After accomplishing these requirements, every node can establish the actions’ call.

4.3 Delay-based evaluation

Our system contains different computational operations: prediction operation, trust calculation, and transaction publishing in a blockchain network. We propose to study the computational time of those main operations in Table 5.

Table 5. Time-based evaluation

In the gateway, when the system is about to update the trust, we have two main operations namely prediction and the update. The old trust recuperation is from the IoT edge and not from the blockchain. Thus, the trust calculation will be equal to 0.0036 seconds. Compared to prediction and trust calculation, the process, including blockchain communication, is higher. However, it does not affect our system performance since it does not depend on direct communication with the blockchain but rather on the IoT edge. Additionally, trust modification will only be triggered when a notable change in the trust score is detected. Minor variations or unchanged trust levels will not be recorded on the blockchain in order to minimize processing time.

4.4 Comparative study

In this section, a comparative study is established between our work and Yang et al’s work [10]. They present an approach in an IoT environment with the deployment of trust based on blockchain. Table 6 details the simulation environments.

Table 6. Test environment comparison

First, we tried to compare the reputation evolution. The authors presented the effect of the NR and PR decrease on their reputation score. We will present our reputation progress with values variating in PDR, Energy consumption, and medical trust, and with modifying in each time period the attack probability. We fitted updated weights as follows: λ = 0.3 and μ = 0.7. Regarding weights of metrics: α, β, and γ equal 0.2 while δ = 0.4.

The first curve in Figure 11, having PR equal to 5 with no NR, is increasing. Our approach has different attributes and uses the IDS decision in calculating trust. We obtain a decrease in trust when the attack probability increases. In fact, the probability p starts with a value of 1 in instant ∆t = 0, but when it becomes p = 0, we find that the trust value is under the trust threshold fixed by Yang et al. [10]. Added to that, the last three occurrences in the curve have values inferior to the threshold. As a result, following our proposed algorithm, this node is rejected from the network.

tu_pian_19.png

Figure 11. Trust score variation

Second, we moved forward to the blockchain evaluation. We tested the write transaction latency, where we tested the different delays when the transaction number per second varies. The work by Yang et al. [10] used ganache in simulation, representing one node (defined by an IP address and a port). To get a fair comparison, we fix our test on one node in the GoQuorum blockchain. The latency chart in Figure 12 shows that our blockchain network returns an increasing latency value proportionally to the transaction rate as proposed in the paper. Compared to other processes in our approach, the latency value remains acceptable and ensures the rapidity of the transaction process.

Added to that, we evaluated the trust update throughput values as illustrated in Figure 13. In Figure 13(a), we represented the throughput of our blockchain. Throughput, expressed in Transaction Per Second (TPS), is defined as the average number of correctly handled transactions according to received transaction flow per second [28].

In fact, as the number of transactions increases, the throughput rises accordingly. For comparison purposes, we selected a specific window from our performance curve to use in the comparison analysis with the Yang et al’s [10] throughput values in Figure 13(b). The Value remains acceptable since it does not exceed 30 TPS.

tu_pian_20.png

Figure 12. Write transactions latency

tu_pian_21.png

tu_pian_22.png

Figure 13. Throughput comparison for updating trust

tu_pian_23.png

Figure 14. Throughput variation

To evaluate blockchain throughput, we conducted multiple tests, each varying the number of threads. In this context, a thread represents a user interacting with the blockchain. As the number of threads increases, the volume of transactions rises proportionally. As illustrated in Figure 14, the throughput curves exhibit an upward trend, indicating that the throughput improves with higher transaction rates. This demonstrates GoQuorum's capability to efficiently handle a high volume of transactions. For instance, with three concurrent users, the throughput peaks at a maximum of 480 TPS.

To summarize, our trust model maintains a level of security since it always controls the network, and the trust score reflects the degree of network reliability. Moreover, the permissioned blockchain network is a real network that can be upgraded to a production environment. It offers an average latency of 9.06 ms and a throughput attaining 260 TPS for a high transaction volume.