One-class detection for IoMT network traffic
Internet of Medical Things networks have a property that makes supervised intrusion detection awkward: you can collect as much normal traffic as you like, and almost none of the other kind. An infusion pump talking to a monitoring server produces the same handful of patterns for months. The attack you actually care about has not happened yet — and when it does, it will probably not look like anything in your training set.
This is the setting for my thesis, and it pushed me away from classification and toward one-class modelling.
Why not just train a classifier
The obvious approach is to label traffic as benign or malicious and train a binary classifier. Two things go wrong.
The first is arithmetic. Attack traffic is rare, so accuracy stops meaning anything — a model that predicts “benign” for everything scores well and detects nothing. I wrote about that in the first post on this site.
The second is worse. A supervised model learns the boundary between the normal traffic you have and the specific attacks you have. Deploy it against a technique that was not in the training set and it has no reason to flag anything. You have built a detector for yesterday’s attacks.
One-class models invert the question. Instead of learning what an attack looks like, they learn a tight boundary around normal behaviour and treat everything outside it as suspicious. You never have to enumerate the attacks. That fits the data you can actually collect from a hospital network.
Turning flows into small images
I used DROCC — Deep Robust One-Class Classification — with a convolutional backbone, which means the model wants something image-shaped as input. Network flow records are not image-shaped; they are a row of numbers.
So each flow’s 36 features get reshaped into a 6×6 single-channel grid and treated as a tiny grayscale image. Convolution then sees small neighbourhoods of features at once rather than one long flat vector.
This is a real modelling decision, not just plumbing: a convolution over a 6×6 grid only ever mixes features that ended up adjacent, so the ordering of the columns matters. Features that belong together should sit together. It is the part of the pipeline I would poke at first if the numbers were disappointing.
The collapse problem
One-class objectives have an obvious degenerate solution. If the only instruction is “map normal data somewhere consistent”, the network can satisfy it by mapping everything — normal traffic, attacks, random noise — to a single point. Loss goes to zero. The model has learned nothing. This is representation collapse, and it is the reason naive one-class training often produces something that looks trained and detects nothing.
DROCC’s answer is to make the trivial solution impossible. It assumes normal points lie on a locally linear, low-dimensional manifold, then generates adversarial negative points by gradient ascent in a shell just outside each training point — close enough to be plausible, far enough to be wrong. The model is trained to separate real points from those synthetic near-misses.
A constant function cannot do that. To push the fake points away while keeping the real ones, the boundary has to actually hug the shape of normal traffic. That is the mechanism, and it is what makes the approach work at all rather than just appear to.
Results
Two public datasets, one from IoMT device traffic and one from a healthcare monitoring testbed:
| Dataset | Domain | Accuracy |
|---|---|---|
| CIC-IoMT-2024 | IoMT device traffic | 0.92 |
| WUSTL-EHMS-2020 | Healthcare monitoring system | 0.97 |
The gap between the two is the interesting part. WUSTL-EHMS-2020 comes from a smaller, more constrained testbed, so “normal” is a tighter target and the boundary can be drawn closer around it. CIC-IoMT-2024 covers a wider variety of devices and behaviours, so normal is a bigger, messier region — and a bigger region is harder to wrap tightly without letting attacks inside it.
That is the general shape of the tradeoff in one-class detection. The more varied your normal traffic, the looser your boundary, and the more attacks slip through it.
What I would want next
Accuracy is the headline number, but it is not the number that decides whether a detector is deployable. For an intrusion detection system what matters is the false positive rate at a useful detection rate — a model that flags 3% of a hospital’s normal traffic is switched off in a week, whatever its accuracy is. A full ROC curve, and per-attack-family recall, would say much more than a single figure.