Abstract:
Despite the significant benefits that the IoHT offered to the medical sector, there are
concerns and risks regarding these systems which can delay their wide deployment as
they handle sensitive, and often life-critical medical information. In addition to the
IoHT concerns and risks, there are security constraints which include hardware,
software, and network constraints that pose a security challenge to these systems.
Therefore, security measures need to be deployed that can overcome the concerns,
mitigate the risks, and meet the constraints of the IoHT. For these reasons, a
subclasses intrusion detection system for the IoHT is proposed in this research work
based on a novel variation of the standard OSVM, namely SDOSVM, which
considers subclasses in the target class, i.e. normal class, in order to minimize the data
dispersion within and between subclasses thus improving the discriminative power
and classification performance of the intrusion detection system.

To the best of knowledge, this research work is the first to explore the usage of
subclasses one-class classification in anomaly-based IoHT network intrusion
detection in order to incorporate IoHT data subclasses information related to diverse
normal behaviors, and improve detection accuracy.

The proposed subclasses intrusion detection system was evaluated using the real-world TON_IoT dataset, and compared to other state-of-the-art ML one-class
classifiers. Experimentation results showed that the proposed approach outperformed
the other relevant ML one-class classifiers for network intrusion detection in terms of
AUC, where the AUC scores achieved by the proposed approach were above 96%.
Also, the proposed approach outperformed the one-class SVM-based classifiers in
terms of training time, which did not exceed one second, due to its reliance on a low
number of SVs thus resulting in lower computational complexity. Finally, the
proposed approach achieved the best results than the one-class classifiers for the FPR,
which did not exceed 1%, and the TPR in most evaluation subsets of the TON_IoT
dataset which was above 98.5%.