Attention-Enhanced CNN–BiLSTM Intrusion Detection for Cross-Layer Patient-State Dissociation Attacks in Smart Hospital IoMT Systems

Advanced cyberattacks in life-critical Internet of Medical Things (IoMT) environments may preserve normal network availability while creating subtle inconsistencies between physiological conditions, transmitted telemetry, alarm behavior, and clinician-visible information. This study proposes an attention-enhanced CNN–BiLSTM intrusion detection framework for identifying a novel patient-state perception dissociation attack in smart hospital IoMT systems. The attack deliberately separates the patient’s actual physiological state from the information presented across interconnected clinical and cyber-physical layers, allowing dangerous deterioration to remain externally plausible and difficult to detect using conventional traffic-based intrusion detection mechanisms. To support realistic evaluation, a multi-zone smart hospital testbed was implemented in GNS3, incorporating heterogeneous medical devices, IoMT gateways, telemetry servers, clinical workstations, alarm components, security-monitoring nodes, and adversarial access paths. A stage-aware dataset was subsequently generated to represent benign operation, intrusion progression, gateway compromise, telemetry manipulation, alarm interference, contextual obfuscation, and complete cross-layer dissociation. Within the proposed architecture, convolutional layers learn local cross-feature relationships, bidirectional long short-term memory layers capture forward and backward temporal dependencies, and an attention mechanism emphasizes the telemetry–alarm–context deviations most indicative of hidden cyber-physical manipulation. Evaluation across fifteen operational and adversarial scenarios produced 98.57% validation accuracy, 98.43% testing accuracy, a 97.93% F1-score, and an area under the receiver operating characteristic curve of 0.998. The small validation–testing performance gap further indicates stable generalization to previously unseen samples. These results demonstrate that attention-guided deep learning can extend intrusion detection beyond conventional network anomalies by identifying semantically inconsistent attack behavior across multiple IoMT layers, providing a practical foundation for deployable threat monitoring in life-critical smart hospital environments.