The healthcare industry relies heavily on a robust medical infrastructure but generates sensitive data about patients whose confidentiality and integrity protection must be guaranteed. But, although the Internet of Medical Things (IoMT) facilitates the interconnection of medical devices, software applications, and health systems, it also introduces vulnerabilities for adversaries to exploit. Moreover, in recent years, integrating machine learning (ML) into intrusion detection systems (IDS) have shown great potential in identifying malicious actions in the Internet of Things. However, such methods often require representative data for training, which is not commonly available for the IoMT. In this work, we introduce the IoMT-TrafficData , a dataset comprising IoMT network traffic data with features built over packet and network flow information for benign traffic and eight types of attacks. We present results from using several traditional ML algorithms and deep models to identify malicious traffic (binary classification) and the type of attack (multiclass classification), along with a comparative analysis of employing packet and flow statistics in ML-based intrusion detection. We show that ML algorithms can achieve high performance in identifying malicious traffic and distinct attacks, as most of the evaluated methods achieved an F1-score of over 90%. We also show that their performance on traffic-packets is, on average, almost 3% better for identifying malicious traffic than the individual attacks, and they achieve up to 5% better performance when dealing with traffic-flow statistics than when working on packed-based features. Hence, our experiments show the potential of using IoMT traffic flows in ML-based IDS and the usefulness of the IoMT-TrafficData dataset in such a context and present results that may be a benchmark reference for those who work with the dataset. The dataset can be openly accessed through the DOI 10.5281/zenodo.8116337.

The absence of essential security protocols in Industrial Internet of Things (IIoT) networks introduces cybersecurity vulnerabilities and turns them into potential targets for various attack types. Although machine learning has been used for intrusion detection in the IIoT, datasets with representative data of common attacks of IIoT network traffic are limited and often imbalanced. Data augmentation techniques address these problems by creating artificial data in classes with fewer samples. In this work, we evaluate the use of data augmentation when training intrusion detection models based on IIoT traffic data. We compare Generative Pre-trained Transformers (GPT) and variations on the Synthetic Minority Over-sampling TEchnique (SMOTE) and evaluate their capability to enhance intrusion detection performance. We examine the performance of five intrusion detection algorithms when trained with augmented datasets to models trained with the original non-augmented dataset. To ensure a fair comparison, we evaluated the algorithms’ performance in the different scenarios using the same test dataset, which does not contain synthetic data. The results show the need for a systematic evaluation before employing data augmentation, as its impact on classification performance depends on the algorithm, data, and used technique. While deep neural networks benefit from data augmentation, the eXtreme Gradient Boosting (XGBoost), which achieved superior performance in intrusion detection between all evaluated classifiers (with F1-Score over 91%), didn’t have any performance improvement when trained with augmented data. The evaluation of data generated by GPT-based methods shows such methods (especially GReaT) generate invalid data for both numerical and categorical features in a way that leads to performance degradation in multiclass classification.