Dynamic-kernel CNN-LSTM for real-time intrusion detection in low-power healthcare IoT systems

Osita Miracle Nwakeze; Naveed Uddin Mohammed; Obaze Caleb Akachukwu; Umerah Anthony Tochukwu; Oji Nkechi Blessing; Ibeh Sylvarine Chinasa; Odeh Christopher

doi:10.46481/jnsps.2026.3230

Authors

Osita Miracle Nwakeze ma.nwakeze@coou.edu.ng Department of Computer Science, Chukwuemeka Odumegwu Ojukwu University, Uli, Anambra State, Nigeria
Naveed Uddin Mohammed Department of Computer Science, Lindsey Wilson University, Columbia, Kentucky, USA
Obaze Caleb Akachukwu Department of Computer Science, Dennis Osadebay University, Asaba, Delta State, Nigeria
Umerah Anthony Tochukwu Department of Computer Engineering, Federal University of Technology, Owerri, Imo State, Nigeria
Oji Nkechi Blessing Department of Computer Engineering, Federal University of Technology, Owerri, Imo State, Nigeria
Ibeh Sylvarine Chinasa Department of Computer Science, Chukwuemeka Odumegwu Ojukwu University, Uli, Anambra State, Nigeria
Odeh Christopher Department of Computer Science, Dennis Osadebay University, Asaba, Delta State, Nigeria

Keywords:

Array, Array, Array, Array, Array

Abstract

Cybersecurity has become a serious concern in healthcare Internet of Things (IoT) systems, where connected medical devices support patient monitoring, diagnosis, and treatment but remain vulnerable to attacks. This paper presents a Dynamic-kernel Convolutional Neural Network--Long Short-Term Memory (DyK-CNN-LSTM) architecture for energy-efficient intrusion detection in healthcare IoT environments. The model combines SoftMax-gated dynamic convolutional kernels with bidirectional LSTM layers to learn multi-scale spatial dependencies and temporal correlations in network traffic. Causal pooling is incorporated to support low-latency, simulation-based real-time inference on low-power devices. Experiments on the IoT Healthcare Security and CICIoMT-2024 datasets produced an integrated-dataset accuracy of 98.42%, precision of 98.35%, recall of 98.41%, F1-score of 98.38%, and false alarm rate of 1.58%. Attack-specific analysis showed consistently strong detection across DDoS, replay, ransomware, brute-force, data-exfiltration, botnet, scanning, and backdoor attacks. Hardware-aware simulation on a 100 MHz ARM Cortex--M4 target indicated an energy consumption of 92.3 µJ and a latency of 24.5 ms per inference, with real hardware validation planned as future work. The proposed DyK-CNN-LSTM framework therefore offers a balanced design for accurate, scalable, and energy-aware intrusion detection in medical IoT systems.

853 327

References

[1] S. K. Garg, M. Kipnes, K. Castorino, T. S. Bailey, H. K. Akturk, J. B. Welsh, M. P. Christiansen, A. K. Balo, S. A. Brown, J. L. Reid & S. E. Beck, ``Accuracy and safety of Dexcom G7 continuous glucose monitoring in adults with diabetes'', Diabetes Technology & Therapeutics 24 (2022) 373. https://doi.org/10.1089/dia.2022.0011.

[2] T. Martens, R. W. Beck, R. Bailey, K. J. Ruedy, P. Calhoun, A. L. Peters, R. Pop-Busui, A. Philis-Tsimikas, S. Bao, G. Umpierrez, G. Davis, D. Kruger, A. Bhargava, L. Young, J. M. McGill, G. Aleppo, Q. T. Nguyen, I. Orozco, W. Biggs, K. J. Lucas, W. H. Polonsky, J. B. Buse, D. Price & R. M. Bergenstal, ``Effect of continuous glucose monitoring on glycemic control in patients with type 2 diabetes treated with basal insulin: a randomized clinical trial'', JAMA 325 (2021) 2262. https://doi.org/10.1001/jama.2021.7444.

[3] J. T. Kelly, K. L. Campbell, E. Gong & P. Scuffham, ``The Internet of Things: impact and implications for health care delivery'', Journal of Medical Internet Research 22 (2020) e20135. https://doi.org/10.2196/20135.

[4] S. Heydari & Q. H. Mahmoud, ``Tiny Machine Learning and on-device inference: a survey of applications, challenges, and future directions'', Sensors 25 (2025) 3191. https://doi.org/10.3390/s25103191.

[5] S. S. Saha, S. S. Sandha & M. Srivastava, ``Machine learning for microcontroller-class hardware: a review'', IEEE Sensors Journal 22 (2022) 21362. https://doi.org/10.1109/JSEN.2022.3210773.

[6] M. Horowitz, Computing's energy problem (and what we can do about it), Proceedings of the 2014 IEEE International Solid-State Circuits Conference Digest of Technical Papers, San Francisco, CA, USA, 2014, p. 10. https://doi.org/10.1109/ISSCC.2014.6757323.

[7] Y. Chen, X. Dai, M. Liu, D. Chen, L. Yuan, and Z. Liu, Dynamic convolution: attention over convolution kernels, Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA, 2020, p. 11083. https://doi.org/10.48550/arXiv.1912.03458.

[8] J. Zhang, X. Tang, Y. Yang, C. Ying, Y. Zhang & N. Han, ``Enhancing network intrusion detection with adaptive spatial convolution and salient contrastive learning'', Computer Networks 281 (2026) 112226. https://doi.org/10.1016/j.comnet.2026.112226.

[9] A. Nazir, J. He, N. Zhu, S. S. Qureshi, S. U. Qureshi, F. Ullah, A. Wajahat & M. S. Pathan, ``A deep learning-based novel hybrid CNN-LSTM architecture for efficient detection of threats in the IoT ecosystem'', Ain Shams Engineering Journal 15 (2024) 102777. https://doi.org/10.1016/j.asej.2024.102777.

[10] W. Ishtiaq, A. Zannat, A. H. M. S. Parvez, M. A. Hossain, M. H. Kanchan & M. M. Tarek, ``CST-AFNet: a dual attention-based deep learning framework for intrusion detection in IoT networks'', Array 27 (2025) 100501. https://doi.org/10.1016/j.array.2025.100501.

[11] A. Harshavardhan, M. S. Vani, A. Patil, N. Yamsani & K. Archana, ``Hybrid deep learning framework for intrusion detection: integrating CNN, LSTM, and attention mechanisms to enhance cybersecurity'', Journal of Theoretical and Applied Information Technology 103 (2025) 63. https://doi.org/10.5281/zenodo.15246084.

[12] A. Gueriani, H. Kheddar & A. C. Mazari, ``Enhancing IoT security with CNN and LSTM-based intrusion detection systems'', arXiv preprint, arXiv:2405.18624 (2024). https://doi.org/10.48550/arXiv.2405.18624.

[13] T. N. Ghorsad & A. V. Zade, ``Hybrid CNN+LSTM deep learning model for intrusions detection over IoT environment'', International Journal on Recent and Innovation Trends in Computing and Communication 11 (2023) 1. https://doi.org/10.17762/ijritcc.v11i10s.7588.

[14] P. Sinha, D. Sahu, S. Prakash, T. Yang, R. S. Rathore & V. K. Pandey, ``A high performance hybrid LSTM-CNN secure architecture for IoT environments using deep learning'', Scientific Reports 15 (2025) 9684. https://doi.org/10.1038/s41598-025-94500-5.

[15] P. Phalaagae, A. M. Zungeru, A. Yahya, B. Sigweni & S. Rajalakshmi, ``A hybrid CNN-LSTM model with attention mechanism for improved intrusion detection in wireless IoT sensor networks'', IEEE Access 13 (2025) 57322. https://doi.org/10.1109/ACCESS.2025.3555861.

[16] M. S. Alshehri, O. Saidani, F. S. Alrayes, S. F. Abbasi & J. Ahmad, ``A self-attention-based deep convolutional neural networks for IIoT networks intrusion detection'', IEEE Access 12 (2024) 45762. https://doi.org/10.1109/ACCESS.2024.3380816.

[17] D. M. A. A. Afraji, J. Lloret & L. Peñalver, ``An integrated hybrid deep learning framework for intrusion detection in IoT and IIoT networks using CNN-LSTM-GRU architecture'', Computation 13 (2025) 222. https://doi.org/10.3390/computation13090222.

[18] A. S. Mirkhail & Z. Xinyou, ``Deep learning for anomaly detection in IoT healthcare systems'', International Research Journal of Multidisciplinary Scope 6 (2025) 1480. https://doi.org/10.47857/irjms.2025.v06i02.03768.

[19] N. Imtiaz, A. Wahid, S. Z. U. Abideen, M. M. Kamal, N. Sehito, S. Khan, B. S. Virdee, L. Kouhalvandi & M. Alibakhshikenari, ``A deep learning-based approach for the detection of various Internet of Things intrusion attacks through optical networks'', Photonics 12 (2025) 35. https://doi.org/10.3390/photonics12010035.

[20] A. Momand, S. U. Jan & N. Ramzan, ``ABCNN-IDS: attention-based convolutional neural network for intrusion detection in IoT networks'', Wireless Personal Communications 136 (2024) 1981. https://doi.org/10.1007/s11277-024-11260-7.

[21] M. Sajid, K. R. Malik, A. Almogren, T. S. Malik, A. H. Khan, J. Tanveer & A. U. Rehman, ``Enhancing intrusion detection: a hybrid machine and deep learning approach'', Journal of Cloud Computing 13 (2024) 123. https://doi.org/10.1186/s13677-024-00685-x.

[22] V. Kantharaju, H. Suresh, M. Niranjanamurthy, S. I. Ansarullah, F. Amin & A. Alabrah, ``Machine learning based intrusion detection framework for detecting security attacks in Internet of Things'', Scientific Reports 14 (2024) 30275. https://doi.org/10.1038/s41598-024-81535-3.

[23] F. S. Alsubaei, ``Smart deep learning model for enhanced IoT intrusion detection'', Scientific Reports 15 (2025) 20577. https://doi.org/10.1038/s41598-025-06363-5.

[24] A. M. Alashjaee, ``Deep learning for network security: an Attention-CNN-LSTM model for accurate intrusion detection'', Scientific Reports 15 (2025) 21856. https://doi.org/10.1038/s41598-025-07706-y.

[25] H. Zhang, ``Development of an intelligent intrusion detection system for IoT networks using deep learning'', Discover Internet of Things 5 (2025) 74. https://doi.org/10.1007/s43926-025-00177-7.

[26] B. Omarov, Z. Sailaukyzy, A. Bigaliyeva, A. Kereyev, L. Naizabayeva & A. Dautbayeva, ``One-dimensional Conv-BiLSTM network with attention mechanism for IoT intrusion detection'', Computers, Materials & Continua 77 (2023) 3765. https://doi.org/10.32604/cmc.2023.042469.

[27] F. Malik, ``IoT Healthcare Security Dataset'', Kaggle, 2024. Available online: https://www.kaggle.com/datasets/faisalmalik/iot-healthcare-security-dataset.

[28] Canadian Institute for Cybersecurity, ``CICIoMT-2024: a comprehensive multi-protocol Internet of Medical Things (IoMT) security dataset'', University of New Brunswick, 2024. Available online: https://www.unb.ca/cic/datasets/iomt-dataset-2024.html.

[29] M. A. Talukder, M. M. Islam, M. A. Uddin, K. F. Hasan, S. Sharmin, S. A. Alyami & M. A. Moni, ``Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction'', Journal of Big Data 11 (2024) 33. https://doi.org/10.1186/s40537-024-00886-w.

[30] K. C. Santos, R. S. Miani & F. d. O. Silva, ``Evaluating the impact of data preprocessing techniques on the performance of intrusion detection systems'', Journal of Network and Systems Management 32 (2024) 36. https://doi.org/10.1007/s10922-024-09813-z.

[31] G. S. Vidhya & R. Nagarajan, ``A novel bidirectional LSTM model for network intrusion detection in SDN-IoT network'', Computing 106 (2024) 2613. https://doi.org/10.1007/s00607-024-01295-w.

[32] I. Yoon, J. Mun & K.-S. Min, ``Comparative study on energy consumption of neural networks by scaling of weight-memory energy versus computing energy for implementing low-power edge intelligence'', Electronics 14 (2025) 2718. https://doi.org/10.3390/electronics14132718.