Explainable Intrusion Detection for Internet of Medical Things

IoMT sensors are used for continuous real-time remote monitoring of patients’ health indicators. IoMT integrate several devices to capture sensitive medical data from devices such as implants and wearables that results in cost-effective and improved health. In IoT settings, the Message Queuing Telemetry Transport (MQTT) protocol is frequently used for machine-to-machine data transfer. However, secure transmission of sensitive health data is critical because these devices are resource constrained and are more vulnerable to MQTT based threats including brute force attack. This warrants a robust, effective, and reliable threat mitigation mechanism, while maintaining a fine balance between accuracy and interpretability. Based on a comprehensive overview of previous work and available datasets, we propose an explainable intrusion detection mechanism to detect MQTT-based attacks. The MQTT-IOT-IDS2020 dataset is used as a benchmark. Particle swarm optimization (PSO) is used for the selection of optimal features from the dataset. The performance of ten machine learning (ML) methods is evaluated and compared. The results demonstrate excellent classification accuracies between 97% and 99%. We applied LIME explanations to increase human interpretability for the best performing model.