A Unified AI Framework for Confidentiality Preserving Cyberattack Detection in Healthcare Cyber Physical Networks

Abstract

Healthcare Cyber-Physical Systems (HCPS) are increasingly exposed to sophisticated cyberattacks that compromise both service continuity and patient privacy. Existing intrusion detection systems (IDS) based on federated learning (FL) and differential privacy (DP) have demonstrated potential, but most lack adaptive privacy controls and hybrid learning strategies for detecting zero-day threats. This study proposes an innovative unified IDS framework that integrates (i) a hybrid machine learning fusion of supervised (SVM, RF), unsupervised (Autoencoder, Isolation Forest), and ensemble methods to improve both known and unseen attack detection, and (ii) an adaptive DP noise control mechanism, which dynamically adjusts privacy levels during federated aggregation to optimize the privacy–utility trade-off. Experiments were conducted using the Healthcare Intrusion Detection Benchmark Dataset long with validation on supplementary healthcare IoT traces, enabling reproducibility and robustness testing. Results show that the proposed framework achieves 97.5% accuracy, 96.8% precision, 95.9% recall, F1-score of 96.3%, and AUC-ROC of 98.2% without DP, and maintains competitive performance at strict privacy settings (ε=0.1) with 85.3% accuracy and F1-score of 83.4%. Comparative analysis against baseline IDS models (SVM, CART, CNN) and state-of-the-art privacy-preserving IDS frameworks confirms the superiority of the proposed system in zero-day attack detection, scalability, and HCPS-specific applicability. The findings demonstrate that adaptive, privacy-preserving IDS solutions are feasible for real-world digital healthcare environments.