Comparative Performance of Machine-Learning Algorithms for Detecting Network Intrusions in Internet-of-Medical-Things Environments: A Systematic Technical Evidence Synthesis

Abstract

Background: The Internet of Medical Things (IoMT) connects wearable sensors, bedside monitors, implantable devices, gateways, clinical systems and cloud infrastructure. Although connectivity supports continuous monitoring and more efficient healthcare delivery, it also introduces network attack surfaces capable of affecting confidentiality, integrity, availability and potentially patient safety. Machine-learning-based intrusion detection systems (IDSs) have therefore received increasing attention.
Objective: To compare machine-learning approaches available through 2021 for detecting network intrusions in IoMT environments and identify algorithmic and deployment characteristics most appropriate for healthcare networks.
Methods: A structured technical evidence synthesis was conducted using peer-reviewed studies published no later than 31 December 2021. References were restricted to Q1 journals in cybersecurity, networking, artificial intelligence, Internet of Things and biomedical informatics. IoMT-specific studies were prioritized and supplemented with high-quality IoT intrusion-detection research where algorithms, datasets or methodological principles were directly transferable. Classical machine learning, ensemble learning and deep-learning approaches were compared across discrimination, multiclass detection, computational demand, interpretability, class imbalance, validation methodology and deployment feasibility.
Results: Random Forest and related ensemble methods consistently demonstrated strong performance for structured network-flow data while retaining moderate computational and interpretive advantages. Deep belief networks and recurrent architectures demonstrated high detection performance for complex or sequential attack patterns. Hybrid CNN-LSTM models offered automatic feature learning and temporal modeling but required greater computational resources. A 2021 optimized deep recurrent approach reported 99.76% overall accuracy, while earlier IoMT studies demonstrated high detection performance using Random Forest, deep belief networks and ensemble architectures. However, direct ranking was inappropriate because studies used different datasets, attacks, feature sets and validation procedures. Dataset representativeness, class imbalance, false-alarm burden and computational location were at least as important as headline accuracy.
Conclusion: No single algorithm can be considered universally optimal for IoMT intrusion detection. For structured flow-level data, Random Forest and ensemble methods provide a strong accuracy-efficiency compromise. Deep and recurrent architectures are attractive when temporal or high-dimensional attack patterns justify additional computational cost. Practical IoMT IDSs should employ layered deployment, per-class evaluation, temporally independent validation and explicit measurement of latency, false alarms and resource consumption.