Dual-layer edge intelligence for secure real-time medical IoT: a Zero-Trust sequential framework integrating soft-voting intrusion detection and Histogram Gradient Boosting
- 1Faculty of Computer Science and Information Technology, Universiti Malaysia Sarawak
- 2College of Computing and Information Technology, University of Bisha
Abstract
Introduction: The Internet of Medical Things (MIoT) enables continuous transmission of patient vital signs for real-time monitoring and clinical decision making in intensive care units. A lot of different and interdependent devices are used in these medical settings in order to ensure time and reliability for healthcare services. But with 24/7 connectivity comes the danger of cyberattacks, unauthorized access and tampered medical information. Cloud-based processing also causes delays in communication and reliance on network availability and could impact the timely delivery of critical clinical alerts. The current studies are mostly related to patient monitoring, or network intrusion detection, and only a few merge both these functions within a single edge computing setup.
Methods: This article proposes a Dual-Layer Edge Intelligence Framework for secure real-time Medical IoT. The framework executes two Artificial Intelligence modules sequentially on a ward-level edge node. A Security AI Module, built on a soft-voting ensemble, screens every network flow first and acts as a Zero-Trust gate. Only traffic that it clears as benign is passed to the Healthcare AI Module, built on Histogram Gradient Boosting, which screens the patient's physiological state for anomaly-based indicators of critical deterioration. This sequential design makes sure that none of the clinical decisions are taken based on unverified information, while at the same time making sure there is safe interaction between network management and healthcare analytics. The framework was tested with two benchmark datasets, which are CICIDS-2017 and MIMIC-IV.
Results: : The Security AI Module has an accuracy of 99.4% with a false positive rate of less than 2% and the Healthcare AI Module has a cross-validated accuracy of 98.97% and ROC-AUC of 0.995 with complete recall on all the validation folds. The complete sequential pipeline achieved an end-to-end latency of approximately 28.8 ms, making it suitable for real-time intensive care monitoring.
Discussion: A permissioned Hyperledger Fabric ledger with IPFS off-chain storage is presented as a conceptual future governance layer; it is not implemented or evaluated in this study. The findings show that adopting Zero-Trust security and clinical intelligence in one edge framework offers a viable paradigm for secure, low-latency, and trustworthy Medical IoT systems.
Related
- An EfficientNet hybrid deep learning detection framework of network intrusion with an optimized mixture-of-experts architecture
- An energy-aware and lightweight spiking neural network framework for real-time intrusion detection in IoT networks
- Causality-driven hybrid intrusion detection with entropy-aware feature learning and federated intelligence
- A conceptual framework integrating artificial intelligence with failure mode and effects analysis for diagnostic error reduction in anatomical pathology
- Clinical Reasoning, Pathophysiology, and Artificial Intelligence in Critical Care: A Conceptual Framework for Integrating Decision-Making
BibTeX
@article{shaheen2026duallayer,
title = {{Dual-layer edge intelligence for secure real-time medical IoT: a Zero-Trust sequential framework integrating soft-voting intrusion detection and Histogram Gradient Boosting}},
author = {Reema Shaheen and Adnan Shahid Khan and Irshad Ahmed Abbasi},
journal = {Frontiers in Public Health},
year = {2026},
month = oct,
doi = {10.3389/fpubh.2026.1974012},
url = {https://www.frontiersin.org/articles/10.3389/fpubh.2026.1974012/full},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Dual-layer edge intelligence for secure real-time medical IoT: a Zero-Trust sequential framework integrating soft-voting intrusion detection and Histogram Gradient Boosting
AU - Reema Shaheen
AU - Adnan Shahid Khan
AU - Irshad Ahmed Abbasi
PY - 2026
DA - 2026/10/29
JO - Frontiers in Public Health
DO - 10.3389/fpubh.2026.1974012
UR - https://www.frontiersin.org/articles/10.3389/fpubh.2026.1974012/full
AB - Introduction: The Internet of Medical Things (MIoT) enables continuous transmission of patient vital signs for real-time monitoring and clinical decision making in intensive care units. A lot of different and interdependent devices are used in these medical settings in order to ensure time and reliability for healthcare services. But with 24/7 connectivity comes the danger of cyberattacks, unauthorized access and tampered medical information. Cloud-based processing also causes delays in communication and reliance on network availability and could impact the timely delivery of critical clinical alerts. The current studies are mostly related to patient monitoring, or network intrusion detection, and only a few merge both these functions within a single edge computing setup. Methods: This article proposes a Dual-Layer Edge Intelligence Framework for secure real-time Medical IoT. The framework executes two Artificial Intelligence modules sequentially on a ward-level edge node. A Security AI Module, built on a soft-voting ensemble, screens every network flow first and acts as a Zero-Trust gate. Only traffic that it clears as benign is passed to the Healthcare AI Module, built on Histogram Gradient Boosting, which screens the patient's physiological state for anomaly-based indicators of critical deterioration. This sequential design makes sure that none of the clinical decisions are taken based on unverified information, while at the same time making sure there is safe interaction between network management and healthcare analytics. The framework was tested with two benchmark datasets, which are CICIDS-2017 and MIMIC-IV. Results: : The Security AI Module has an accuracy of 99.4% with a false positive rate of less than 2% and the Healthcare AI Module has a cross-validated accuracy of 98.97% and ROC-AUC of 0.995 with complete recall on all the validation folds. The complete sequential pipeline achieved an end-to-end latency of approximately 28.8 ms, making it suitable for real-time intensive care monitoring. Discussion: A permissioned Hyperledger Fabric ledger with IPFS off-chain storage is presented as a conceptual future governance layer; it is not implemented or evaluated in this study. The findings show that adopting Zero-Trust security and clinical intelligence in one edge framework offers a viable paradigm for secure, low-latency, and trustworthy Medical IoT systems.
SN - 2296-2565
ER -