Enhancing IoMT Network Threat Detection with Data Balancing for Multi-Class Attack Classification on CICIoMT2024 Dataset

The rapid growth of the IoMT has resulted in critical security threats to healthcare infrastructure, which require highly sophisticated IDSs that can detect a wide range of and unbalanced attack patterns. This study has addressed a critical challenge faced by network security data, which is class imbalance, by presenting a comprehensive evaluation of data balancing techniques on both a real-world standard data set, CICIoMT2024, and a synthetic data set, SynIoMT2026, which we generated to mimic the characteristics of the standard data set for developing a highly controlled data set. Three data balancing techniques, ADASYN, Sample Weighting, and a hybrid technique involving both SMOTE and SMOTEEN, were systematically applied and evaluated on the severely class-imbalanced data set, wherein the majority classes, such as DDoS_UDP with $\sim$2M instances, far outweigh the minority classes, such as Recon_Ping_Sweep with 926 instances. The balanced data sets were used to train and evaluate a range of ML models, including random forest, AdaBoost, logistic regression, and DNN models for binary classification, 6-class classification, and 19-class classification. The proposed method achieved outstanding results, with 99.8% model accuracy achieved for binary classification. The results of the evaluation have demonstrated the robustness of the random forest algorithm, which showed accuracy ranging from 97% to 99% in all scenarios. The results have demonstrated the potential of strategic balancing in unlocking the potential of the model, especially in the results obtained from the AdaBoost model, where the SMOTE-SMOTEEN technique showed a significant increase in accuracy in 6-class classification from 69.8% to 91.6%, and even more dramatic results in 19-class classification, increasing accuracy from 23.6% to 51.9%. This has demonstrated the need to select the optimal balancing technique to unlock the potential of the model. The results have also demonstrated high accuracy in the SynIoMT2026 synthetic dataset, showing 99% accuracy in training, covering six categories, and 89% accuracy in nineteen categories, with minimal overhead. This study has demonstrated the viability of using synthetic datasets in model development and has provided a balanced dataset that has been tested in both real-world and synthetic environments.