HospGNN-IDS: scalable graph neural network-based intrusion detection for IoT-enabled hospital networks

The rapid digitalization of healthcare systems, driven by the introduction of IoT-enabled devices and the integration of hospital systems, has dramatically increased vulnerability to advanced cyberattacks, such as coordinated, multi-stage attacks. The classical intrusion detection systems (IDS) are generally not able to reflect the rich structural and temporal associations present in such a set-up. To overcome these weaknesses, the given paper introduces a HospGNN-IDS, a large scale graph neural network-based intrusion detector framework designed specifically to be used in a hospital network based on IoT technology. The models recommended frame network traffic as a chain sequence of time graphs; the devices appear as nodes, and their relations as edges, which allows seizing relational and dynamic patterns of communication. The hybrid architecture that combines Graph Attention Networks (GAT) to learn spatial dependency and Long Short-Term Memory (LSTM) networks to learn temporal modelling is used to apply it to isolated and coordinated attacks and detect them effectively. Furthermore, a focal loss operation is added to address the problem of class imbalance and enhance the ability to detect rare types of attacks. Extensive experiments using the IoT Healthcare and TON-IoT datasets show that the proposed model is much more effective than traditional machine learning, deep learning, and baseline graph-based approaches, with an accuracy of up to 99.2 and a high F1-score. The findings confirm the usefulness, scalability and timeliness of the suggested framework in safeguarding contemporary hospital network settings.