Abstract
Abstract The Internet of Medical Things (IoMT) enables remote patient monitoring, providing timely diagnostic assessments crucial for saving lives. Despite these benefits, IoMT systems face significant security challenges that endanger patient privacy and data integrity. Existing centralized machine learning (ML) and deep learning (DL) solutions, while useful, are “black boxes” that raise critical concerns about data privacy and ethical compliance, as sharing sensitive patient information in a centralized system may violate confidentiality, integrity, and availability, particularly in healthcare sectors where patient data is highly confidential. Motivated by these challenges, we propose a novel federated learning (FL) explainable deep recurrent neural network (DRNN)-augmented long short-term memory (LSTM) framework for anomaly intrusion in IoMT systems, named federated recurrent short-term memory. The proposed decentralized framework processes data on local devices, sharing only learned model weights with the central server to safeguard data integrity. Training the DRNN-LSTM presents a non-convex optimization problem that is computationally expensive. To address this issue, we propose a new Bayesian Optimization (BO) method, which models the objective function stochastically and intelligently selects the most promising hyperparameter configurations to identify the hyperparameter vector that maximizes the objective function. The Adam optimizer was implemented to address gradient descent resource issues and improve the speed of convergence with a learning rate of 0.001. We introduced Shapley Additive Explanations (XAI) to ensure security decisions are transparent, a key advantage over existing black-box approaches that helps meet ethical guidelines such as HIPAA and GDPR. The framework was evaluated on the Washington University in St. Louis Enhanced Healthcare Monitoring System (WUSTL-EHMS), as well as the new CIC-IoMT2024 (IoMT-specific) and BoT-IoT (general IoT) benchmark datasets. The results show strong detection capabilities, with high detection rates for critical attack types such as DoS with 99.94%, DoS SYN with 100%, and DoS TCP with 100%. The model also demonstrated exceptionally high precision for classes like DoS SYN, DDoS TCP, and ARP spoofing. Our proposed federated recurrent short-term memory framework achieves a robust balance between detection fidelity and computational efficiency, making it a reliable solution for intrusion detection in resource-constrained IoMT infrastructures.