A Dynamic Temporal Attention Model for Intrusion Detection in Medical IoT Networks

Medical Internet of Things (IoMT) networks face critical threats from stealthy, long-duration attacks. Existing methods predominantly rely on static feature analysis, severing the temporal causality required to trace slow-rate threat evolution. While recurrent architectures attempt to model dependencies, standard continuous sliding windows suffer from restricted receptive fields and anomalous signal dilution. To reconcile temporal scope expansion with detection fidelity, we propose MHA-LSTM-Dilated. First, a Fully Connected Autoencoder (FC-AE) compresses heterogeneous features into a 16-dimensional latent manifold, establishing a high-fidelity normal baseline. Second, a skip-sampled dilated sliding window expands the macroscopic temporal receptive field by 50% without escalating computational cost. Third, a Multi-Head Attention (BiLSTM-MHA) engine computes parallel adaptive alignment scores, anchoring extreme weights exclusively on anomalous mutation frames to isolate incorporated background noise. Optimized via a joint Focal and differentiable Soft-F1 loss metric, the architecture achieves an F1-score of 0.9489 on the highly imbalanced WUSTL-EHMS-2020 dataset and 0.9941 on CICIDS2017. Ablation studies validate the theoretical necessity of front-end manifold compression, proving that decoupled dimensionality reduction enables high-order sequence models to suppress clinical false alarms effectively without overfitting in sample-scarce environments.