MoE-TS-IDS: A Mixture-of-Experts Time Series Model for Intrusion Detection in Medical IoT Networks

Internet of Medical Things (IoMT) networks face severe intrusion threats where heterogeneous traffic exhibits multi-scale temporal patterns under class imbalance. Existing single-model IDS fail to simultaneously capture local, sequential, and global flow features. We propose MoE-TS-IDS, a Mixture-of-Experts Time Series IDS that serializes traffic features intotime series, encodes them via a BiLSTM encoder, and routes them through three parallel expert networks (CNN, LSTM, Transformer) with a learnable gating network and multi-head attention fusion. On WUSTL-EHMS-2020 (3-class),MoE-TS-IDS achieves 99.97% accuracy and AUC 1.0000.On CICIDS2017 (binary), it achieves 98.08% Macro F1 and AUC 0.9997, surpassing all deep learning baselines by +2.43% Macro F1. Ablation studies confirm contributions of the BiLSTM encoder (−1.93%), dynamic gating (−1.32%), and attention fusion (−0.95%). Gating weight analysis reveals polarized routing: normal traffic favors LSTM (g2=0.906) and attack traffic favors Transformer (g3=0.898), demonstrating interpretable autonomous expert specialization.