A Hybrid CNN-Transformer Approach for Predicting Attack Severity in Electronic Health Monitoring Systems to Strengthen Cybersecurity

Electronic Health Monitoring Systems (EHMS) have revolutionized patient care through continuous, connected monitoring. However, their pervasive connectivity exposes them to evolving cyber threats. In this context, for a resilient, real‑time Intrusion Detection System (IDS), we propose a novel hybrid Convolutional Neural Network–Transformer (CNN–Transformer) architecture that integrates the spatial feature extraction and long‑range sequence modelling functionality. The framework is trained on the publicly available WUSTL-EHMS-2020 network traffic dataset. The model features a dual-output head that simultaneously: (i) classifies attack types and (ii) predicts attack severity on a continuous scale. To address the dataset's severe class imbalance, the Synthetic Minority Oversampling Technique (SMOTE) is employed. Experimental results show the model achieves a classification accuracy of 83.33%, macro F1-score of 0.93, and Receiver Operating Characteristic Area Under the Curve (ROC-AUC) of 0.96, and severity regression achieves a Mean Absolute Error (MAE) of 0.3337 and an R2 0.89. Shapley Additive Explanations (SHAP) provide model interpretability, revealing packet length and inter-arrival time as key predictive features. The proposed IDS outperforms state‑of‑the‑art CNN, Long Short-Term Memory (LSTM), and ensemble baselines in the precision on minority classes. It is also computationally efficient, requiring only a single NVIDIA RTX 3080 Graphics Processing Unit (GPU) with <2 GB VRAM per batch, and delivers inference latency below 150 ms, meeting clinical real-time requirements. These findings make the hybrid CNN–Transformer a viable and deployment-ready approach to protect EHMS against cyber-attacks, in a scalable and explainable manner.