A Tsetlin Machine-driven Intrusion Detection System for Next-Generation IoMT Security

Rahul Jaiswal; Per-Arne Andersen; Linga Reddy Cenkeramaddi; Lei Jiao; Ole-Christoffer Granmo

cs.CRApr 3, 2026

A Tsetlin Machine-driven Intrusion Detection System for Next-Generation IoMT Security

Authors: Rahul Jaiswal, Per-Arne Andersen, Linga Reddy Cenkeramaddi, Lei Jiao, Ole-Christoffer Granmo

Organizations: The Centre for Artificial Intelligence Research (CAIR), Department of ICT, University of Agder, Norway

Abstract

The rapid adoption of the Internet of Medical Things (IoMT) is transforming healthcare by enabling seamless connectivity among medical devices, systems, and services. However, it also introduces serious cybersecurity and patient safety concerns as attackers increasingly exploit new methods and emerging vulnerabilities to infiltrate IoMT networks. This paper proposes a novel Tsetlin Machine (TM)-based Intrusion Detection System (IDS) for detecting a wide range of cyberattacks targeting IoMT networks. The TM is a rule-based and interpretable machine learning (ML) approach that models attack patterns using propositional logic. Extensive experiments conducted on the CICIoMT-2024 dataset, which includes multiple IoMT protocols and cyberattack types, demonstrate that the proposed TM-based IDS outperforms traditional ML classifiers. The proposed model achieves an accuracy of 99.5% in binary classification and 90.7% in multi-class classification, surpassing existing state-of-the-art approaches. Moreover, to enhance model trust and interpretability, the proposed TM-based model presents class-wise vote scores and clause activation heatmaps, providing clear insights into the most influential clauses and the dominant class contributing to the final model decision.

Figures & tables

Fig. 1: A simple illustration of IoMT working in healthcare.

Fig. 2: The overall architecture of the proposed TM-based IDS.

Protocol: Bluetooth
S.No.	Feature name	S.No.	Feature name	S.No.	Feature name	S.No.	Feature name
1	Header_Length	2	Protocol_Type	3	Packet_Type	4	Rate
5	HCI_Command	6	HCI_Event	7	HCI_ACL_Data	8	HCI_SCO_Data
9	Command_Complete	10	Command_Status	11	LE_Meta	12	Connection_Complete
13	Disconnection_Complete	14	Inquiry_Complete	15	Advertising_Report	16	Read_Remote_Features
17	Encryption_Change	18	Number_Completed_Packets	19	Tot_sum	20	Min

TABLE I: List of features present in CICIoMT24.

IoMT Protocol	Attack type	Number of samples
		Training	Testing
Bluetooth	Benign	21750	6533
	DoS	99840	25171
	Total samples	121590	31704
MQTT and Wi-Fi	Benign	19291	37607
	DoS	1805529	416676

TABLE II: Different attacks present in CICIoMT24.

Fig. 3: Class imbalance in Scenario 1: Binary classification.

Fig. 4: Balanced training class in Scenario 1.

Model	Parameters
TM	Binarizer: KBinsDiscretizer, n_bins =5,
	encode= onehot-dense , strategy=quantile
	number_of_clauses =100, $T$ =10, $s$ =2,
	weighted_clauses =False, Epochs=10
DT	class_weight=balanced
RF	class_weight=balanced

TABLE III: Parameters used for models in Scenario 1.

Model	Accuracy	Precision	Recall	F1-score	Inference time
	(in %)	(in %)	(in %)	(in %)	(in microseconds $\text{\,}\mathrm{\SIUnitSymbolMicro s}$ )
TM	0.995	0.999	0.991	0.995	0.743
DT	0.997	0.997	0.997	0.997	0.045
RF	0.998	0.999	0.996	0.998	1.930
XGBoost	0.998	0.999	0.997	0.998	0.140
LGBM	0.998	0.999	0.996	0.998	0.516

TABLE IV: Model performance in Scenario 1.

Fig. 5: TM confusion matrix in Scenario 1 (two classes).

Fig. 6: Class-wise votes of a Benign sample in Scenario 1.

Fig. 7: Clause activation heatmap of the same Benign sample.

Fig. 8: Class imbalance in Scenario 2: Multi-class (six-class) classification.

Fig. 9: Balanced training class in Scenario 2.

Model	Parameters
TM	Binarizer: The same settings as in Table III
	number_of_clauses =100, $T$ =10, $s$ =5,
	weighted_clauses =False, Epochs=15
DT, RF	compute_class_weight method with class_weight=balanced
XGBoost	objective=multi:softprob, eval_metric =mlogloss,
	tree_method =hist, learning_rate =0.1,

TABLE V: Parameters used for models in Scenario 2.

Model	Accuracy	Precision	Recall	F1-score	Inference time
	(in %)	(in %)	(in %)	(in %)	(in microseconds $\text{\,}\mathrm{\SIUnitSymbolMicro s}$ )
TM	0.907	0.913	0.907	0.906	4.056
DT	0.803	0.858	0.856	0.857	0.217
RF	0.816	0.869	0.875	0.872	17.588
XGBoost	0.862	0.868	0.927	0.890	1.498
LGBM	0.860	0.866	0.925	0.888	3.953

TABLE VI: Model performance in Scenario 2.

Fig. 10: Training and Testing accuracy of the TM model.

Fig. 11: TM confusion matrix in Scenario 2 (six classes).

Fig. 12: Class-wise votes of a Recon sample in Scenario 2.

Fig. 13: Clause activation heatmap of the same Recon sample.

Fig. 14: Class imbalance in Scenario 3: Seven classes.

Model	Parameters
TM	Binarizer: The same settings as in Table V
	number_of_clauses =120, $T$ =15, $s$ =2, Epochs=15
DT, RF, XGBoost,	The same settings as in Table V
LGBM, KNN, NB, LR
NN	The same settings as in Table V except
	input layer=11 neurons, output layer=7 neurons

TABLE VII: Parameters used for models in Scenario 3.

Model	Accuracy	Precision	Recall	F1-score	Inference time
	(in %)	(in %)	(in %)	(in %)	(in microseconds $\text{\,}\mathrm{\SIUnitSymbolMicro s}$ )
TM	0.884	0.889	0.884	0.884	5.413
DT	0.785	0.863	0.863	0.863	0.180
RF	0.800	0.876	0.878	0.877	15.470
XGBoost	0.851	0.882	0.920	0.895	1.650
LGBM	0.788	0.807	0.888	0.820	4.319

TABLE VIII: Model performance in Scenario 3.

Fig. 15: Class-wise votes of a Benign sample in Scenario 3.

Fig. 16: Class-wise votes of a DDoS sample in Scenario 3.

	Model	Class	Accuracy	Precision	Recall	F1-score
Paper [ 11 ]	DNN/	Binary	0.99	0.99	0.99	0.99
	LSTM	Six	0.78	0.77	0.77	0.75
Paper [ 12 ]	ML	Binary	0.996	0.971	0.951	0.961
	Classifier	Six	0.735	0.735	0.713	0.676
Proposed	Tsetlin	Binary	0.995	0.999	0.991	0.995
	Machine	Six	0.907	0.913	0.907	0.906

TABLE IX: Comparison with the state-of-the-art methods.

Explainable Intrusion Detection

See all 14 papers

On-Device Interpretable Tsetlin Machine-Based Intrusion Detection for Secure IoMT
May 15, 2026Rahul Jaiswal, Per-Arne Andersen, Linga Reddy Cenkeramaddi +2Network Intrusion Detection Interpretable ML
Department of ICT, University of Agder, Norway
Federated Temporal Attention Intelligence for Cyber-Resilient IoMT: Lightweight Digital Twins and PPO-Driven Honeypot Deception
Jun 19, 2026Syed Zeeshan Haider, Anwar Shah, Muneeb Arif +2Federated RL Autonomous Cyber Defense
FAST National University of Computer and Emerging Sciences, Islamabad, Pakistan
Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments
Aug 1, 2026Amira Berrezzek, Hayet Djellali, Giulio Mallardi +1IoT Intrusion Detection Network Intrusion Detection
Computer Science Dept. Badji Mokhtar University Annaba, Algeria · Computer Science Dept. University of Bari Bari, Italy

May 15, 2026J/K move · Enter open · S save

On-Device Interpretable Tsetlin Machine-Based Intrusion Detection for Secure IoMT

Rahul Jaiswal, Per-Arne Andersen, Linga Reddy Cenkeramaddi, Lei Jiao+1

Department of ICT, University of Agder, Norway

Network Intrusion Detection Interpretable ML

Open paper AskPDF arXiv

The rapid evolution of digital health technologies is redefining healthcare services worldwide. The integration of wireless communication and Internet-enabled medical devices within Internet of Medical Things (IoMT) networks enables continuous, real-time patient monitoring. However, this increased connectivity raises cybersecurity and patient safety risks due to increasingly sophisticated cyberattacks. This paper proposes a novel on-device, interpretable Tsetlin Machine (TM)-based Intrusion Detection System (IDS) to identify various phases of cyberattacks in IoMT environments. The TM is a rule-driven and transparent machine learning (ML) approach that represents attack patterns using propositional logic. Extensive evaluations on the MedSec-25 dataset, encompassing various phases of realistic cyberattacks, show that the proposed model outperforms ML models, attaining an F1-score (macro) of 97.83%. Moreover, the proposed model offers explicit explanations of its decisions to enhance transparency using feature-level contributions, class-wise vote scores, and clause activation heatmaps. Edge deployment (Raspberry Pi) further supports real-time on-device inference and intrusion detection. The combination of interpretability and high performance makes the proposed model well-suited for IoMT healthcare, where trust, reliability, safety, and timely decision-making are critical.

Abstract

Explainable Intrusion Detection

Explore similar work

On-Device Interpretable Tsetlin Machine-Based Intrusion Detection for Secure IoMT

Federated Temporal Attention Intelligence for Cyber-Resilient IoMT: Lightweight Digital Twins and PPO-Driven Honeypot Deception

Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments