The Internet of Medical Things (IoMT) has become integral to modern healthcare, yet its always-connected and resource-constrained nature enlarges the attack surface and complicates timely intrusion detection. This study presents a deployment-oriented, two-stage anomaly-detection pipeline. First, Principal Component Analysis (PCA) is employed to reduce the dimensionality of network traffic data, capturing the most significant variance. Subsequently, a One-Class Support Vector Machine (OC-SVM) is trained exclusively on these principal components of normal traffic. This approach prioritizes computational efficiency for resource-constrained IoMT devices while maintaining high model robustness. By modeling the principal components of normal behavior, our method achieves state-of-the-art performance across diverse attack families. We adopt a uniform protocol across four public IoMT corpora—BoT-IoT, CICIoMT2024, ECU-IoHT, and IoMT-TrafficData. The model’s hyperparameters, including the optimal number of principal components determined by explained variance, are tuned via randomized search. Despite using no attack labels during training, the proposed PCA-enhanced detector achieves state-of-the-art performance across diverse attack families: on BoT-IoT we obtain 99.92% F1-score (99.84% accuracy), on CICIoMT2024 we obtain 99.88% F1-score (99.77% accuracy), on ECU-IoHT 99.25% F1-score (98.58% accuracy), and on IoMT-TrafficData 99.19% F1-score (98.66% accuracy). The compact model size, enabled by PCA, makes the approach highly amenable to edge or gateway deployment in clinical networks, while the normal-only training paradigm improves robustness to zero-day threats. The results demonstrate that modeling the principal components of routine network behavior is a highly effective and efficient strategy for reliable, low-latency threat detection in realistic IoMT settings.
Gencturk et al. (Sat,) studied this question.