MACHINE LEARNING BASED ANOMALY DETECTION FOR INTERNET OF THINGS DEVICES IN SMART HOSPITALS

This abstract addresses the critical cybersecurity vulnerabilities introduced by widespread IoT deployment in smart hospitals, which support real-time patient monitoring and automated clinical workflows. Using the N-BaIoT dataset comprising 692,552 network traffic samples across four medical IoT devices — a thermostat, baby monitor, security camera, and webcam, with an original distribution of 302,657 benign samples (43.7%) and 389,895 attack samples (56.3%) generated by the BASHLITE (Gafgyt) botnet, three machine learning models are implemented and evaluated: Random Forest, Logistic Regression, and Isolation Forest. To address the inherent class imbalance, Synthetic Minority Oversampling Technique (SMOTE) is applied exclusively to the training set, increasing the benign sample count to approximately twice the attack sample count and rebalancing the training distribution to favour normal traffic, more accurately reflecting real-world hospital network conditions. Following rebalancing, ANOVA F-test feature selection reduces the 115-dimensional input space to the 20 most statistically discriminative features per device. Random Forest achieves the best performance, attaining 100% accuracy and F1-score on the thermostat and security camera, and 99.99% on the baby monitor and webcam, with a 0.0% false positive rate across all four devices. Compared to the original N-BaIoT benchmark study (Meidan et al., 2018), which trained deep autoencoders and reported 100% true positive rate but an average false positive rate of approximately 3.57%, the proposed Random Forest model maintains equivalent recall while reducing the false positive rate to 0.0% — a substantial improvement in detection precision critical for operational hospital environments where false alarms disrupt clinical workflows. The trained models are integrated into a full-stack web application comprising a Flask REST API backend and an interactive dashboard supporting real-time traffic monitoring, automated attack alerting, and per-device model performance visualisation, delivering a fully deployable proof-of-concept for smart hospital IoT anomaly detection.