Blockchain-Integrated Bidirectional Long Short-Term Memory Network for Real-Time Intrusion Detection in Healthcare Internet of Medical Things

Summary

This protocol describes the implementation of a blockchain-integrated bidirectional long short-term memory intrusion detection system for healthcare Internet of Medical Things networks, enabling real-time attack detection, tamper-proof forensic logging, and automated mitigation.

Abstract

Healthcare Internet of Medical Things (IoMT) environments require intrusion detection systems that not only identify cyberattacks accurately but also provide forensic accountability, auditability, and rapid response capabilities. Conventional intrusion detection approaches primarily emphasize classification performance while offering limited support for tamper-proof event recording and post-incident investigation. This study presents a forensic-aware intrusion detection framework that integrates an Extended Bidirectional Long Short-Term Memory (BiLSTM) network with a permissioned blockchain layer to support real-time detection, secure logging, and automated mitigation in healthcare IoMT systems. The protocol combines data preprocessing, AQU-IMF-RFE feature selection, temporal sequence modeling, attention-based learning, residual connections, and blockchain-based event recording. The Extended BiLSTM model was trained and evaluated independently on the UNSW-NB15, CICIDS2017, and Bot-IoT benchmark datasets using reproducible preprocessing, stratified data partitioning, and fixed random seeds. Intrusion events detected by the model were recorded on a Proof-of-Authority blockchain through smart contracts that enabled immutable logging and automated response actions. Experimental results demonstrated high intrusion detection performance with low false-positive rates across all evaluated datasets while maintaining forensic traceability and real-time response capability. The blockchain layer provided tamper-resistant audit records and automated mitigation without introducing prohibitive computational overhead. These findings demonstrate that integrating deep-learning-based intrusion detection with blockchain-enabled forensic logging improves the trustworthiness, accountability, and practical deployability of healthcare cybersecurity systems.

Introduction

In the healthcare system, digitization has led to a new era of intelligent, connected, and patient-centered healthcare services. Modern medical infrastructure heavily relies on network communication and data exchange between wearable sensors, remote patient monitoring systems, electronic health records (EHRs)^1,2, and intelligent diagnostic platforms. However, this increasing interconnectivity also expands the attack surface of healthcare networks, exposing them to cyber threats such as data breaches, ransomware, distributed denial-of-service (DDoS) attacks, and man-in-the-middle attacks³

Protocol

All experiments were conducted exclusively using publicly available benchmark network intrusion datasets (UNSW-NB15, CIC-IDS-2017, and Bot-IoT), which contain network traffic records without identifiable personal or medical information. The datasets were used in accordance with their respective licenses and terms of use. Because no human participants, patient samples, or identifiable personal data were involved, institutional ethics approval and informed consent were not required.

Overview of the Proposed Framework
This section presents the proposed dual-layer intrusion detection and prevention framework for securing Io....

Results

The results are organized to mirror the methodological steps of the Protocol, with each subsection reporting the observations produced by the corresponding step.

Dataset handling and experimental setup
The three benchmark datasets were analyzed independently rather than merged. Because UNSW-NB15, CICIDS2017, and Bot-IoT use different feature schemas and labeling conventions, each dataset was preprocessed, windowed, and evaluated separately using its own 80:20 train/test sp.......

Discussion

The present study proposes an integrated Extended BiLSTM–Blockchain framework for intrusion detection and prevention in IoMT environments. The results demonstrate that the framework effectively identifies intrusion patterns in heterogeneous IoMT network traffic by combining bidirectional temporal learning with blockchain-based forensic logging. The bidirectional architecture enables the model to capture both forward and backward temporal dependencies within network traffic, resulting in high precision (99.44%), a r.......

Materials

List of materials used in this article

Name	Company	Catalog Number	Comments
AQU-IMF-RFE Feature Selection Module	Self-developed	N/A	Hybrid feature-selection method integrating Mutual Information, Aquila Optimizer, and Recursive Feature Elimination
Attention Layer	Self-developed (Keras-based)	N/A	Temporal attention mechanism used for feature weighting in the Extended BiLSTM model
Bot-IoT Dataset	UNSW Canberra Cyber	N/A	Public benchmark dataset used for intrusion-detection evaluation
CICIDS2017 Dataset	Canadian Institute for Cybersecurity	N/A	Public benchmark intrusion-detection dataset
Ethereum Client (Geth)	Ethereum Foundation	1.13.15	Blockchain client used to deploy and operate the Proof-of-Authority network
Extended BiLSTM Model	Self-developed	N/A	Deep-learning intrusion detection model integrating Conv1D, BiLSTM, residual learning, and temporal attention
Jupyter Notebook	Project Jupyter	7.x	Interactive environment used for implementation, experimentation, and result visualization
NumPy	NumPy Developers	2.4.4	Numerical-computing library used for preprocessing and model training
Pandas	Pandas Development Team	3.0.2	Data-processing library used for preprocessing and data analysis
Proof-of-Authority Blockchain Network	Self-developed	N/A	Permissioned blockchain network used for immutable intrusion logging and automated mitigation
Python	Python Software Foundation	3.12.7	Programming language used for data preprocessing, model development, blockchain integration, and evaluation
Random Forest Estimator	Scikit-learn Developers	N/A	Random Forest classifier used for Recursive Feature Elimination (RFE)
Scikit-learn	Scikit-learn Developers	1.8.0	Machine-learning library used for preprocessing, feature selection, and model evaluation
Solidity Compiler (solc)	Solidity Team	0.8.19	Compiler used for smart-contract compilation and deployment
Solid-State Drive (SSD)	Dell	512 GB	Storage used for datasets, trained models, and blockchain ledger
System Memory (RAM)	Dell	128 GB	Main memory used during preprocessing, model training, blockchain execution, and evaluation
TensorFlow	Google	2.16.1	Deep-learning framework used to implement and train the Extended BiLSTM model
UNSW-NB15 Dataset	UNSW Canberra Cyber	N/A	Public benchmark dataset used for training and evaluation
Web3.py	Web3.py Developers	6.15.1	Python interface used for communication between the intrusion detection system and the blockchain network
Windows Operating System	Microsoft	Windows 11	Operating system used for all experiments
Workstation / Server	Dell	PowerEdge R740	Computing platform used for model training, blockchain deployment, and evaluation