Enhancing IoMT Security using Multi-Layer Authentication: ZTM and ML-Based Case Study

Abstract

The growing use of the Internet of Medical Things (IoMT) in ambulances enables real-time transmission of patients’ vital signs to hospitals. However, this exchange is increasingly exposed to cyber threats, especially Distributed Denial of Service (DDoS) and data injection or spoofed attacks that can delay critical decisions and compromise patient safety. This loMT system is subject to various kinds of attacks across multiple layers. While many existing solutions focus on securing medical data through encryption or blockchain in a mobile medical environment, they do not focus on detecting anomalies during transmission or analyzing network and data content behavior in real-time. This thesis proposes a real-time security framework for Emergency Medical Services (EMS) that continuously monitors and analyzes both levels, network and data content, based on the principle of “never trust, always verify.” The aim is to detect specific threats and take immediate action in real time before the data reach the hospital. The model integrates Machine Learning (ML), a Signature Intrusion Detection System (SIDS), the Zero Trust Model (ZTM), and Two-Factor Authentication (2FA) to simulate the application at two levels: (1) DDoS attacks at the network level with a general description and less simulation; (2) data injection attacks at the content level with focusing and discussion in detail at this level. Once an attack is detected, the system applies an isolation mechanism that either isolates the compromised IoMT device from its network at the ambulance in case data injection comes from that device, or disconnects the ambulance’s network interface in case of DDoS at the network level, preventing further propagation of malicious traffic. ML classifiers such as Decision Tree (DT), K-Nearest Neighbors (KNN), and Random Forest (RF) are trained in the cloud represented in our work by the hospital and then tested at the edge node (ambulance), which is the closest point to the data collection to ensure real-time decision-making and optimize resource usage under the constraints of mobile medical environments. The simulation results demonstrate that the DT model achieved the best performance for multiclass classification at the data-content level (attack, medical issue, normal), with an overall accuracy of 98.096% and an Matthews’ Correlation Coefficient (MCC) of 97.172%. This compared with other models, including RF with an accuracy of 98.01% and MCC of 97.055%, and KNN with an accuracy of 97.72% and MCC of 96.56%.