On-Device Interpretable Tsetlin Machine-Based Intrusion Detection for Secure IoMT

Technical Summary: On-Device Interpretable Tsetlin Machine-Based Intrusion Detection for Secure IoMT

Problem Statement
The rapid integration of Internet-enabled medical devices into the Internet of Medical Things (IoMT) has enabled continuous, real-time patient monitoring but has simultaneously introduced significant cybersecurity risks. These devices, which transmit highly sensitive health data, are attractive targets for sophisticated cyberattacks that can compromise patient safety, privacy, and system functionality. While Intrusion Detection Systems (IDS) are standard for monitoring network traffic, traditional signature-based and anomaly-based approaches struggle with the dynamic nature of IoMT environments and emerging threats. Furthermore, existing Machine Learning (ML) and Deep Learning (DL) solutions often operate as "black boxes," lacking the interpretability required for trust-critical healthcare applications. Additionally, many high-performance models are too computationally intensive for deployment on resource-constrained edge devices, which are essential for real-time, low-latency detection in IoMT networks.

Methodology
The paper proposes a novel, on-device Intrusion Detection System (IDS) based on the Tsetlin Machine (TM), a rule-driven, interpretable ML approach. The methodology is structured into three primary stages:

1. Data Preparation: The system utilizes the MedSec-25 dataset, which simulates realistic IoMT traffic including benign operations and four distinct cyberattack phases based on the MITRE ATT&CK framework: Reconnaissance, Initial Access, Lateral Movement, and Exfiltration. The dataset contains 554,534 samples with 84 flow-based features. Preprocessing involves handling missing values, normalizing data, and addressing class imbalance. For the TM model, the Synthetic Minority Over-sampling Technique (SMOTE) is applied to the training set, while ML baselines use class weighting. Crucially, continuous features are transformed into binary inputs using a binarizer (KBinsDiscretizer) to align with the TM's logical architecture.
2. Model Training: The core of the system is the Tsetlin Machine, which constructs interpretable conjunctive clauses using propositional logic to represent attack patterns. The model learns by identifying recurring patterns through frequent pattern learning rather than solely minimizing error. A Sparse Tsetlin Machine (STM) variant is also evaluated to introduce controlled sparsity, reducing the influence of irrelevant features. The training process involves hyperparameter tuning, clause formation, and k-fold cross-validation to ensure robustness and prevent overfitting.
3. Edge Deployment: To validate real-time inference capabilities, the trained models are deployed on a Raspberry Pi 5 (a resource-constrained edge device). The system captures network traffic, converts it to flow-based features, preprocesses and binarizes the data, and performs on-device classification to label traffic as benign or malicious.

Key Contributions
The paper outlines five primary contributions:

• Development of an effective TM-based IDS capable of detecting various phases of cyberattacks in IoMT environments.
• Comprehensive evaluation of the IDS in a multi-class setting using the MedSec-25 dataset.
• Numerical evidence demonstrating the proposed IDS's superiority over state-of-the-art ML methods (including Decision Trees, Random Forests, XGBoost, LightGBM, KNN, Naive Bayes, Logistic Regression, and Neural Networks).
• An interpretability analysis that reveals specific decision rules, including feature-level contributions, class-wise vote scores, and clause activation heatmaps, thereby enhancing transparency.
• Successful edge deployment on a Raspberry Pi, demonstrating the feasibility of real-time, on-device inference for attack detection.

Results
Extensive evaluations on the MedSec-25 dataset yielded the following results:

• Classification Performance: The proposed TM model achieved the highest performance among all tested classifiers, attaining an F1-score of 97.83%, with precision and recall also at 97.87% and 97.83%, respectively. The Sparse TM (STM) variant achieved a competitive F1-score of 97.33%.
• Comparison: The TM outperformed all baseline ML models. For instance, while XGBoost achieved a high recall (97.97%), its precision was lower (91.75%), resulting in a lower F1-score (94.47%). Traditional models like Naive Bayes and Logistic Regression performed significantly worse (F1-scores of 44.76% and 61.19%, respectively).
• Inference Time: On the host machine (MacBook M4), the TM required 66.24 µs per inference, which is higher than Logistic Regression (0.05 µs) but competitive with other complex models. On the Raspberry Pi 5, the inference time increased to 230.44 µs for TM and 222.76 µs for STM.
• Resource Efficiency: On the edge device, the TM and STM maintained moderate CPU usage (~25-26%) and manageable memory usage, contrasting sharply with XGBoost and LightGBM, which consumed nearly 99% CPU resources.
• Interpretability: The study provided explicit explanations for model decisions. For example, in classifying benign traffic, the model was shown to suppress non-benign patterns via negative clause votes while activating positive clauses for benign features. Heatmaps visualized the activation of specific clauses for different attack phases, confirming the model's reliance on logical rules rather than opaque weights.

Significance and Claims
The paper claims that the combination of high classification performance and explicit interpretability makes the proposed TM-based IDS particularly well-suited for IoMT healthcare environments. In sectors where trust, reliability, safety, and timely decision-making are critical, the ability to explain why a specific traffic flow was flagged as an attack is as important as the detection accuracy itself. The successful deployment on a Raspberry Pi further validates the model's suitability for real-time, on-device inference in resource-constrained settings, reducing reliance on centralized cloud systems and enabling immediate mitigation of threats. The authors conclude that this approach addresses the dual challenges of detecting sophisticated, multi-phase cyberattacks and providing the transparency necessary for adoption in critical healthcare infrastructure. Future work is noted to involve extending evaluations to self-developed and additional public datasets with broader attack variability.