🤖 machine learning

A Tsetlin Machine-driven Intrusion Detection System for Next-Generation IoMT Security

This paper proposes a novel, interpretable Tsetlin Machine-based Intrusion Detection System for IoMT networks that achieves superior accuracy (99.5% binary, 90.7% multi-class) on the CICIoMT-2024 dataset compared to traditional machine learning classifiers while providing clear insights into model decisions through rule-based logic and visualizations.

Original authors: Rahul Jaiswal, Per-Arne Andersen, Linga Reddy Cenkeramaddi, Lei Jiao, Ole-Christoffer Granmo

Published 2026-04-06

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Rahul Jaiswal, Per-Arne Andersen, Linga Reddy Cenkeramaddi, Lei Jiao, Ole-Christoffer Granmo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a bustling hospital where doctors, nurses, and patients are all connected by a vast, invisible web of smart devices. There are heart monitors on wrists, smart thermometers in rooms, and baby monitors in nurseries. This is the Internet of Medical Things (IoMT). It's like a super-highway for health data, making care faster and better.

But, just like any highway, it has a problem: cybercriminals. These are digital thieves trying to crash the system, steal private patient data, or even trick a doctor into giving the wrong medicine by faking a thermometer reading.

To stop them, hospitals use Intrusion Detection Systems (IDS). Think of an IDS as a security guard at the gate. Its job is to look at every car (data packet) coming in and decide: "Is this a normal patient visiting? Or is this a criminal trying to break in?"

The Old Guards vs. The New Guard

For a long time, security guards relied on rulebooks. They would say, "If a car looks like a red truck, stop it." This works for known criminals, but it fails when a thief shows up in a disguise the guard has never seen before. Also, these rulebooks are rigid and can't handle the massive traffic of a modern hospital.

Then came Machine Learning (ML). These are like guards who have studied millions of photos of criminals. They are smart and fast, but they are often "black boxes." You ask them, "Why did you stop that car?" and they just say, "Because my brain said so." They can't explain their reasoning, which is scary when patient lives are at stake.

Enter the Tsetlin Machine (The "Logic Detective")

This paper introduces a new kind of security guard called the Tsetlin Machine (TM). Instead of being a black box or a rigid rulebook, the TM is a Logic Detective.

Here is how it works, using a simple analogy:

Imagine the TM is trying to spot a thief. Instead of guessing, it builds a list of simple "If-Then" rules (like a detective's notebook):

"IF the car is speeding AND it has no license plate AND it's driving in circles, THEN it's likely a thief."
"IF the car is driving slowly AND has a hospital sticker AND is heading to the ER, THEN it's likely a patient."

The TM learns these rules by playing a game of "yes" and "no" with the data. It's like teaching a child to recognize a cat by showing them pictures and saying, "Cats have whiskers" (Yes) and "Cars have wheels" (No).

Why is this paper special?

The researchers tested this "Logic Detective" on a massive dataset of real and fake hospital attacks (called CICIoMT-2024). Here is what they found:

It's a Super-Smart Guard: In tests, the TM was incredibly accurate. It correctly identified normal traffic 99.5% of the time and caught different types of attacks 90.7% of the time. It actually did better than the other "black box" AI guards in complex situations.
It's Transparent (The "Why" Factor): This is the biggest win. Because the TM uses simple logic rules, we can ask it, "Why did you flag this traffic?" and it can show us its notebook. It might say, "I flagged this because the IP address didn't match the device ID." This builds trust. Doctors and hospital admins can see exactly why the system made a decision.
It's Lightweight: Medical devices (like a pacemaker or a smart watch) have very little battery and computing power. The TM is so efficient it can run on these small devices without draining their batteries, unlike the heavy, power-hungry AI models of the past.

The Results in Plain English

The researchers ran three different tests:

Test 1 (Simple): Distinguishing between "Normal" and "Bad" traffic. The TM was almost perfect.
Test 2 (Complex): Distinguishing between "Normal" and five different types of attacks (like DoS, DDoS, Spoofing, etc.). The TM crushed the competition, outperforming all other methods.
Test 3 (The Big Mix): Combining all types of traffic and attacks. Again, the TM was the champion.

The Takeaway

This paper proposes a new way to protect our digital hospitals. Instead of using a mysterious, powerful AI that we can't understand, they are using a smart, explainable, and efficient Logic Detective.

It's like upgrading from a security guard who just shouts "Stop!" to one who can say, "Stop! You're a thief because you're wearing a mask and running the wrong way, and here is the evidence."

By making security interpretable (easy to understand) and accurate, this Tsetlin Machine approach helps ensure that our medical devices stay safe, our patients stay safe, and the doctors can trust the technology they rely on.

1. Problem Statement

The rapid expansion of the Internet of Medical Things (IoMT) has revolutionized healthcare through seamless connectivity between medical devices, systems, and services. However, this connectivity introduces severe cybersecurity risks. IoMT devices are often resource-constrained and safety-critical, making them vulnerable to various cyberattacks (e.g., DoS, DDoS, Spoofing, Reconnaissance).

Limitations of Current Solutions: Traditional Intrusion Detection Systems (IDS) rely on static rules or signatures, which fail to detect evolving threats. Furthermore, existing Machine Learning (ML) and Deep Learning (DL) approaches, while accurate, often function as "black boxes," lacking interpretability. In healthcare, where patient safety is paramount, understanding why a model flagged an attack is crucial for trust and regulatory compliance.
The Gap: There is a need for an IDS that is not only highly accurate and lightweight (suitable for edge devices) but also interpretable, providing transparent decision-making processes.

2. Methodology

The authors propose a novel Tsetlin Machine (TM)-based Intrusion Detection System. The TM is a rule-based ML framework that uses propositional logic to learn patterns, offering inherent interpretability.

A. System Architecture

The proposed IDS follows a three-stage pipeline:

Data Preparation: Raw network traffic is captured, cleaned (handling missing values), and balanced. Features are extracted and binarized (converted to 0/1) to suit the TM's input requirements.
Model Training: The TM model learns logical clauses (conjunctions of literals) to distinguish between benign and malicious traffic. It uses Tsetlin Automata (TA) to learn which literals to include or exclude in positive and negative clauses.
Deployment: The pre-trained model receives binarized network flow features, computes class scores based on clause activations, and classifies traffic as benign or malicious.

B. The Tsetlin Machine (TM) Mechanism

Logic-Based Learning: Unlike neural networks that use weights, TM uses logical clauses ( $C_j(x)$ ). For a class $c$ , the output is the sum of positive clauses minus the sum of negative clauses.
Interpretability: The model outputs class-wise vote scores and clause activation heatmaps, allowing users to see exactly which logical rules triggered a specific classification.
Parameters: The study utilizes hyperparameters such as the number of clauses ( $m$ ), voting threshold ( $T$ ), and specificity ( $s$ ) to control learning granularity.

C. Experimental Setup

Dataset: CICIoMT-2024, a comprehensive dataset containing traffic from 40 IoMT devices (real and simulated) using Bluetooth, MQTT, and Wi-Fi protocols. It includes benign traffic and six attack types: DoS, DDoS, Reconnaissance, MQTT attacks, and Spoofing.
Scenarios:
- Scenario 1: Binary classification (Bluetooth only: Benign vs. DoS).
- Scenario 2: Multi-class classification (MQTT & Wi-Fi: Benign vs. 5 attack types).
- Scenario 3: Multi-class classification (All protocols combined: Benign vs. 6 attack types).
Comparators: The TM was benchmarked against 8 traditional ML classifiers: Decision Tree (DT), Random Forest (RF), XGBoost, LightGBM (LGBM), K-Nearest Neighbors (KNN), Naive Bayes (NB), Logistic Regression (LR), and Neural Networks (NN).
Preprocessing: SMOTE (Synthetic Minority Over-sampling Technique) was applied to training data to address class imbalance.

3. Key Contributions

Novel TM-based IDS: Design of an effective, data-driven IDS specifically tailored for the resource-constrained and safety-critical nature of IoMT.
Comprehensive Evaluation: Rigorous testing on the CICIoMT-2024 dataset across binary and multi-class scenarios, outperforming state-of-the-art (SOTA) methods.
Explainability Analysis: The paper provides class-wise vote scores and clause activation heatmaps, offering human-readable insights into the decision-making process (e.g., showing which logical clauses contributed to identifying a specific attack).
Performance Benchmarking: Demonstrated that the TM approach achieves superior accuracy in multi-class settings compared to complex deep learning models while maintaining competitive inference times.

4. Key Results

The experiments were conducted on a MacBook M4 (16GB RAM) using Python/TensorFlow.

A. Binary Classification (Scenario 1: Bluetooth)

Accuracy: The TM achieved 99.5% accuracy.
Comparison: While DT, RF, XGBoost, and NN achieved slightly higher or comparable accuracy (99.7%–99.8%), the TM offered a strong balance of performance and interpretability.
Inference Time: TM took 0.743 µs, which is efficient, though slower than Logistic Regression (0.019 µs).
Error Rates: False Positive Rate (FPR) was extremely low at 0.02%.

B. Multi-Class Classification (Scenario 2: MQTT & Wi-Fi)

Accuracy: The TM achieved 90.7% accuracy, significantly outperforming all other classifiers.
- Next Best: XGBoost (86.2%), RF (81.6%), NN (74.3%).
Precision/Recall/F1: TM maintained >90% across all metrics.
Inference Time: 4.056 µs.
Observation: The TM successfully distinguished between complex attack types (e.g., DoS vs. DDoS) where other models struggled.

C. Combined Multi-Class (Scenario 3: All Protocols)

Accuracy: TM achieved 88.4%, again surpassing all competitors (Next best: XGBoost at 85.1%).
Inference Time: 5.413 µs.

D. Comparison with State-of-the-Art (SOTA)

When compared to previous studies using the same dataset (e.g., [11] and [12]):

Binary: TM (99.5%) is comparable to SOTA (99.6%).
Multi-Class: TM (90.7%) significantly outperforms SOTA approaches (73.5% – 78%).

5. Significance and Conclusion

Trust and Transparency: The primary significance of this work is the interpretability of the TM. By visualizing clause activations and vote scores, security analysts can verify why a packet was flagged, which is critical for medical device security where false positives can disrupt patient care.
Efficiency: The TM is lightweight and suitable for edge deployment on IoMT devices, unlike heavy Deep Learning models.
Robustness: The model handles class imbalance and diverse attack vectors effectively, proving its viability for next-generation IoMT security.
Future Work: The authors plan to test the model on real-world physical testbeds and develop a new dataset with more diverse realistic attacks to further validate performance on resource-constrained hardware.

In summary, the paper demonstrates that the Tsetlin Machine is a superior alternative to traditional ML for IoMT intrusion detection, offering a unique combination of high accuracy, low latency, and human-interpretable logic.