💻 computer science

Explainable and Lightweight Deep Belief Network for Intrusion Detection in Internet of Health Things Using Metaheuristic Optimization

This paper proposes an explainable and lightweight Intrusion Detection System for the Internet of Health Things that combines Z-score normalization, PCA optimized by Grey Wolf Algorithm, and a Whale Optimization Algorithm-tuned Deep Belief Network with SHAP/LIME interpretability to achieve high detection accuracy and low computational overhead on edge devices.

Original authors: Abdullah Mujawib Alashjaee, Salahaldeen Duraibi

Published 2026-10-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Abdullah Mujawib Alashjaee, Salahaldeen Duraibi

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern world of healthcare, a quiet revolution is taking place, connecting the human body to the digital realm. Wearable sensors, smart infusion pumps, and remote monitoring devices are no longer isolated tools; they are part of a vast, interconnected network known as the Internet of Health Things. This system allows doctors to track a patient's vital signs from miles away and enables life-saving data to flow instantly between a home and a hospital. However, this constant flow of information creates a vulnerability. Just as a physical hospital needs guards at its doors, this digital network needs protection from intruders who might steal sensitive medical data or disrupt critical care. The challenge is that the devices protecting these networks are often small, battery-powered, and have limited computing power. Traditional security systems are like heavy, power-hungry guards; they are too big and slow to fit on these delicate devices, and when they do raise an alarm, they often offer no explanation for why, leaving medical staff unsure of what to trust.

Researchers Abdullah Mujawib Alashjaee and Salahaldeen Duraibi have developed a new approach to solve this dilemma, creating a security system that is both light enough to run on small medical devices and clear enough for humans to understand. Their work focuses on building a digital watchdog that can spot cyberattacks in real-time without draining the battery of a heart monitor or an insulin pump. To achieve this, they designed a system based on a type of artificial intelligence called a Deep Belief Network, which is essentially a computer program trained to recognize patterns in network traffic. However, instead of using the standard, heavy version of this program, they stripped it down. They removed unnecessary parts and simplified the math inside, creating a "lightweight" version that can operate efficiently on the edge of the network, right where the data is collected.

The researchers tested this new system using two large collections of data that simulate real-world medical and general internet traffic. One dataset, called MedBIoT, contains traffic patterns from actual medical equipment, while the other, BoT-IoT, represents a broader range of internet-connected devices. By feeding these massive amounts of data into their simplified system, the team trained it to distinguish between normal activity and malicious attacks, such as attempts to steal data or flood the network with junk traffic to cause a shutdown. The system proved remarkably effective, correctly identifying attacks with high accuracy on both datasets. In tests using the medical data, it achieved an accuracy rate of 94 percent, and on the broader internet data, it reached 96 percent. Perhaps more importantly, it did this with a tiny memory footprint of just 4.1 megabytes and could make a decision in less than one millisecond per sample, making it fast enough to protect devices in real-time.

A critical innovation in this work is the addition of a layer of transparency, often called explainable artificial intelligence. In the past, when a computer security system flagged a threat, it often acted like a black box, giving a warning without saying why. This is dangerous in healthcare, where a doctor needs to know if an alarm is a genuine threat or a false alarm before taking action. The new system includes tools that act like a spotlight, showing exactly which pieces of information led the computer to its conclusion. For instance, if the system detects an attack, it can highlight that a specific packet of data was unusually large or that a connection was trying to access a port it should not. This clarity allows medical staff to trust the system's warnings and understand the logic behind them, bridging the gap between complex machine learning and human decision-making.

To ensure the system was as efficient as possible, the researchers used a method inspired by nature to fine-tune its settings. They employed an algorithm based on the hunting strategy of humpback whales, which use a bubble-net technique to trap prey. In the digital world, this method helped the system search through thousands of possible configurations to find the perfect balance between speed, accuracy, and size. This process allowed the system to discard redundant features and focus only on the most important clues, further reducing the computing power needed. The result is a security guard that is not only smart and fast but also frugal with resources, making it suitable for the constrained environment of wearable health devices.

The study also looked at how this system could work in a network of hospitals that need to share security knowledge without sharing private patient data. The researchers showed that their system could be part of a federated learning setup, where each hospital trains its own local version of the security model and shares only the lessons learned, not the patient records themselves. This ensures that the system gets smarter over time as it encounters new types of attacks across different regions, all while keeping sensitive medical information secure and private. By combining a simplified, efficient core with clear explanations and privacy-preserving training methods, this research offers a practical path forward for securing the future of connected healthcare. The findings suggest that it is possible to have robust security that does not compromise the speed or battery life of medical devices, nor the trust of the doctors who rely on them.

1. Problem Statement

The Internet of Health Things (IoHT) has revolutionized healthcare through remote diagnostics and real-time monitoring but has introduced severe cybersecurity vulnerabilities, including data breaches, adversarial attacks, and zero-day threats. These risks jeopardize patient safety and data integrity. While Deep Learning (DL) models offer robust detection capabilities, they face two critical barriers in IoHT environments:

Resource Constraints: Conventional DL models are too memory-intensive and power-hungry for deployment on edge devices, wearables, and resource-constrained medical sensors.
Lack of Interpretability: The "black box" nature of deep neural networks hinders clinical adoption, as healthcare professionals require transparency and accountability to trust automated security decisions.

Existing solutions often fail to integrate lightweight architectures, evolutionary optimization, and post-hoc explainability into a single framework tailored specifically for IoHT.

2. Methodology: The Proposed LE-IDS Framework

The authors propose a Lightweight Explainable Intrusion Detection System (LE-IDS) designed for real-time, resource-constrained IoHT environments. The framework follows a modular pipeline:

A. Data Preprocessing

Cleaning: Outliers are handled using Interquartile Range (IQR) filtering, and missing values are imputed via median imputation.
Normalization: Features are standardized using Z-score normalization to ensure equal contribution from all features regardless of magnitude.
Encoding: Categorical data (e.g., protocol types, flags) are label-encoded to ensure compatibility with neural networks.

B. Feature Selection (PCA-GWO Hybrid)

To reduce dimensionality and computational cost:

Principal Component Analysis (PCA): Transforms the input data into an orthogonal subspace to eliminate multicollinearity.
Grey Wolf Optimization (GWO): Optimizes the selection of principal components. GWO mimics the social hierarchy and hunting behavior of wolves to identify the optimal subset of features ( $k$ ) that minimizes classification error while penalizing high dimensionality. The objective function balances accuracy and feature count.

C. Lightweight Deep Belief Network (L-DBN)

The core detection engine is a pruned and quantized Deep Belief Network (DBN), constructed from stacked Restricted Boltzmann Machines (RBMs). To ensure suitability for edge devices, the model employs:

Unsupervised Pretraining: Uses Contrastive Divergence to initialize weights.
Dropout: Randomly disables units during training to prevent co-adaptation and overfitting.
Neuron Pruning: Post-training, neurons with low average weight norms are eliminated based on a user-defined threshold ( $\epsilon$ ).
Quantization: Weights are optionally converted to 8-bit or 16-bit fixed-point precision for deployment on edge runtimes (e.g., TensorFlow Lite).

D. Metaheuristic Optimization (WOA)

The Whale Optimization Algorithm (WOA) is employed to fine-tune the hyperparameters of the DBN (learning rates, dropout ratios, pruning thresholds). WOA simulates the bubble-net hunting strategy of humpback whales to navigate the search space, balancing exploration and exploitation. The objective function minimizes cross-entropy loss while maximizing SHAP interpretability scores and minimizing model size.

E. Explainability Layer (XAI)

To ensure clinical trust and regulatory compliance, the framework integrates post-hoc explainability:

SHAP (SHapley Additive exPlanations): Provides global and local feature importance based on game theory, quantifying each feature's contribution to the prediction.
LIME (Local Interpretable Model-agnostic Explanations): Approximates the local decision boundary by perturbing inputs and fitting a sparse, interpretable model (e.g., linear regression) to explain specific predictions.

F. Federated Learning (Optional Extension)

The architecture supports a Federated Learning (FL) mode where local DBN models are trained on private data at individual hospitals or devices. Model weights are aggregated via FedAvg without exchanging raw patient data, preserving privacy while enabling collaborative learning across diverse IoHT clusters.

3. Key Contributions

The paper outlines five primary contributions:

Lightweight Architecture: Development of a DBN model utilizing quantization, neuron pruning, and dropout to reduce memory and computational footprints.
Hybrid Feature Selection: Integration of PCA with Grey Wolf Optimization (PCA-GWO) for optimal feature subset selection.
Metaheuristic Tuning: Application of the Whale Optimization Algorithm (WOA) to optimize network performance while minimizing resource consumption.
Explainability Integration: Use of SHAP and LIME to provide both local and global feature relevance, enhancing model trustworthiness.
Privacy-Preserving Deployment: An optional Federated Learning extension allowing training across hospital systems without centralizing sensitive data.

4. Experimental Results

The framework was evaluated on two datasets: BoT-IoT (72 million samples, adapted for 600k) and MedBIoT (6.7 million samples), representing general IoT and specific medical telemetry environments, respectively.

Performance Metrics:
- BoT-IoT: Achieved 96% accuracy, 95% F1-score, and an AUC of 0.97.
- MedBIoT: Achieved 94% accuracy, 93% F1-score, and an AUC of 0.95.
Efficiency: The proposed model demonstrated the smallest memory footprint (4.1 MB) and the lowest inference latency (0.9 ms/sample) compared to baselines like Raw DBN, XGBoost, CNN, and LSTM.
Comparative Analysis: The LE-IDS outperformed state-of-the-art baselines (including CNN+SHAP, LSTM+GWO, and Hybrid Autoencoders) in balancing accuracy, model size, and latency.
Explainability: SHAP and LIME analyses confirmed that packet-level metrics (e.g., packet size variation, source/destination bytes) and protocol-specific features (e.g., destination port) were the primary drivers for intrusion detection, validating the model's decision logic.

5. Significance and Claims

The authors claim that this research addresses a critical gap in IoHT security by delivering a system that is simultaneously accurate, lightweight, and interpretable.

Edge Suitability: The drastic reduction in model size and latency makes the system viable for deployment on resource-constrained edge devices and wearables, where traditional deep learning models fail.
Clinical Trust: By integrating SHAP and LIME, the system provides the transparency required for healthcare professionals to understand and trust automated security alerts, reducing false positives and aiding forensic analysis.
Scalability and Privacy: The optional Federated Learning component addresses data privacy concerns, allowing for collaborative security improvements across distributed healthcare networks without compromising patient confidentiality.

The paper concludes that the proposed framework offers a robust, efficient, and auditable solution for securing the evolving smart healthcare ecosystem, with future work planned to include zero-day threat detection via transfer learning and practical validation on wearable devices.