LAG-TabNet: A lightweight attention-gated tabular network for leak-free, interpretable cyberattack detection in internet of health things (IOHT)

The increasing integration of connected medical devices within the Internet of Health Things (IoHT) has intensified the need for intrusion detection systems that combine predictive performance with computational efficiency and interpretability. This study proposes LAG-TabNet, a lightweight attention-gated tabular network designed for cyberattack detection in resource-constrained IoHT environments. Using a leakage-free experimental pipeline, the model was evaluated on the ECU-IoHT dataset across three tasks: multiclass attack classification, packet-length regression, and unsupervised clustering. LAG-TabNet was benchmarked against traditional machine learning, ensemble, distance-based, and deep learning approaches. The proposed model achieved 99.6% classification accuracy, compared with 99.4% for Random Forest and 99.2% for XGBoost, while using only 48,632 trainable parameters. It achieved an R² of 0.974 for packet-length regression, and its learned representations increased clustering adjusted Rand index from 0.79 to 0.87. Attention-derived feature importance strongly correlated with SHAP explanations (Spearman ρ = 0.97), supporting intrinsic interpretability. Ablation and sensitivity analyses further confirmed the contribution and stability of the proposed architecture. Independent retraining on CICIoMT2024 yielded 99.1% accuracy, exceeding Random Forest at 98.9%. Overall, LAG-TabNet provides a promising balance between accuracy, efficiency, and interpretability for IoHT cybersecurity, warranting further validation on representative edge hardware.