A Data-Adaptive Explainable Intrusion Detection Framework for IoMT Using Sampling Strategy Search and Ensemble Learning

In recent years, the widespread adoption of Internet of Medical Things (IoMT) systems in healthcare has provided significant advantages, particularly through rapid decision support and remote monitoring. At the same time, the growing number of heterogeneous and Internet-connected medical devices has expanded the cyberattack surface of healthcare infrastructures. Resource-constrained device characteristics, variable traffic patterns, and evolving attack types make fixed and conventional security mechanisms insufficient, especially for detecting previously unseen threats. This study proposes the Dynamic Data-Driven Pipeline (D3P), an adaptable and explainable intrusion detection framework for IoMT environments. Rather than relying on a fixed balancing strategy or a single predetermined model family, D3P automatically identifies an appropriate sampling strategy, selects the most successful learners from a candidate pool, performs model-specific feature selection, and constructs the final decision mechanism using a stacking-based meta-learner. The framework also incorporates explainability components based on SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), and BorutaSHAP to support both global and local interpretation. Experimental results on the test sets (mean ± standard deviation over five random seeds) show that D3P achieves 0.9701 ± 0.0015 accuracy, 0.9694 ± 0.0019 precision, 0.9701 ± 0.0015 sensitivity, and 0.9697 ± 0.0014 F1-score on WUSTL-EHMS-2020, while reaching 0.9978 ± 0.0004 accuracy, 0.9977 ± 0.0005 precision, 0.9978 ± 0.0005 sensitivity, and 0.9977 ± 0.0005 F1-score in the 6-class scenario of CICIoMT2024. These results indicate that D3P provides a balanced, reliable, and high-performance intrusion detection solution across IoMT datasets with different structural characteristics.