HIFN-Mamba: hybrid information flow networks with selective state-space sequence modeling for intrusion detection in the Internet of Medical Things
Abstract
The exponential growth of the Internet of Medical Things (IoMT)—a multi-billion-device infrastructure of clinically critical sensors, monitors, and connected medical equipment—has dramatically expanded the attack surface for ransomware, lateral-movement, and protocol-specific exploits against healthcare networks. Existing deep-learning intrusion detection systems (IDSs) for this domain suffer from three coupled limitations: fixed information-bottleneck hyperparameters that cannot adapt to heterogeneous protocol distributions, dependence on costly post-hoc explainability methods (SHAP, LIME) that add per-sample computational overhead to latency-sensitive monitoring pipelines, and quadratic-cost attention mechanisms that are costly for high-throughput gateway inspection. This paper proposes HIFN-Mamba, a hybrid architecture that couples a two-layer Hybrid Information Flow Network (HIFN) trunk with a stack of selective state-space (Mamba/S6) sequence blocks. Each HIFN layer learns four information-theoretic regulators end-to-end: a static gate vector providing intrinsic sample-invariant feature interpretability, a magnitude scaling factor preventing latent collapse, an information retention coefficient replacing the fixed beta of the Variational Information Bottleneck, and an entropy budget enforcing a hinge constraint on latent differential entropy. We prove that HIFN strictly generalises VIB and that all four regulators remain bounded for any finite training dynamics. A distinguishing element of our evaluation is a leakage-controlled protocol: guided by the HIFN gates themselves, which ranked an anomalously dominant field at the top of the feature importance, we audited every CICIoMT2024 feature via normalized mutual information with the label, identified a session-level capture identifier (identificador, NMI =0.95 ) and a potential per-capture temporal proxy (IAT, NMI =0.97 ) as testbed artefacts, excluded both, and re-evaluated under a strictly train-fitted 70/15/15 protocol over three random seeds. Under this artefact-excluded protocol HIFN-Mamba attains 99.23 ± 0.08% accuracy and 0.9892 ± 0.0014 macro-F1 on CICIoMT2024 19-class and 99.72 ± 0.04% accuracy on CICIoMT2024 binary (with the artefact features included the same pipeline saturates at 99.995–99.999%, which we report only as an artefact-driven upper bound), with consistent results on two cross-domain benchmarks (UNSW-NB15, CICIDS-2017) and sub-millisecond batched GPU inference latency (0.0129–0.0170 ms/sample). The static gates provide global feature rankings at zero inference cost, complementing per-sample post-hoc attribution methods such as SHAP. To our knowledge, HIFN-Mamba is the first IoMT IDS to combine learned information-theoretic regularisation with linear-time selective state-space modelling under an explicitly leakage-controlled nineteen-class IoMT evaluation.
Versions
Related
- Attention-based intrusion detection using transformer networks on UNSW-NB15
- An energy-aware and lightweight spiking neural network framework for real-time intrusion detection in IoT networks
- Asymmetric class-conditional routing in a federated quantum mixture-of-experts improves imbalanced intrusion detection in edge industrial IoT networks
- An EfficientNet hybrid deep learning detection framework of network intrusion with an optimized mixture-of-experts architecture
- Parrot dandelion optimizer-based routing and spiking neural network enabled intrusion detection in underwater IoT
BibTeX
@article{tawfik2026hifnmamba,
title = {{HIFN-Mamba: hybrid information flow networks with selective state-space sequence modeling for intrusion detection in the Internet of Medical Things}},
author = {Mohammed Tawfik and Muneer A. S. Hazza Almekhlafi and Ghazi Shakah and Nejood Hashim Al-walidi and Islam S. Fathi},
journal = {Scientific Reports},
year = {2026},
month = oct,
doi = {10.1038/s41598-026-73701-6},
url = {https://www.nature.com/articles/s41598-026-73701-6},
note = {CC BY-NC-ND 4.0},
}
RIS
TY - JOUR
TI - HIFN-Mamba: hybrid information flow networks with selective state-space sequence modeling for intrusion detection in the Internet of Medical Things
AU - Mohammed Tawfik
AU - Muneer A. S. Hazza Almekhlafi
AU - Ghazi Shakah
AU - Nejood Hashim Al-walidi
AU - Islam S. Fathi
PY - 2026
DA - 2026/10/02
JO - Scientific Reports
DO - 10.1038/s41598-026-73701-6
UR - https://www.nature.com/articles/s41598-026-73701-6
AB - The exponential growth of the Internet of Medical Things (IoMT)—a multi-billion-device infrastructure of clinically critical sensors, monitors, and connected medical equipment—has dramatically expanded the attack surface for ransomware, lateral-movement, and protocol-specific exploits against healthcare networks. Existing deep-learning intrusion detection systems (IDSs) for this domain suffer from three coupled limitations: fixed information-bottleneck hyperparameters that cannot adapt to heterogeneous protocol distributions, dependence on costly post-hoc explainability methods (SHAP, LIME) that add per-sample computational overhead to latency-sensitive monitoring pipelines, and quadratic-cost attention mechanisms that are costly for high-throughput gateway inspection. This paper proposes HIFN-Mamba, a hybrid architecture that couples a two-layer Hybrid Information Flow Network (HIFN) trunk with a stack of selective state-space (Mamba/S6) sequence blocks. Each HIFN layer learns four information-theoretic regulators end-to-end: a static gate vector providing intrinsic sample-invariant feature interpretability, a magnitude scaling factor preventing latent collapse, an information retention coefficient replacing the fixed beta of the Variational Information Bottleneck, and an entropy budget enforcing a hinge constraint on latent differential entropy. We prove that HIFN strictly generalises VIB and that all four regulators remain bounded for any finite training dynamics. A distinguishing element of our evaluation is a leakage-controlled protocol: guided by the HIFN gates themselves, which ranked an anomalously dominant field at the top of the feature importance, we audited every CICIoMT2024 feature via normalized mutual information with the label, identified a session-level capture identifier (identificador, NMI =0.95 ) and a potential per-capture temporal proxy (IAT, NMI =0.97 ) as testbed artefacts, excluded both, and re-evaluated under a strictly train-fitted 70/15/15 protocol over three random seeds. Under this artefact-excluded protocol HIFN-Mamba attains 99.23 ± 0.08% accuracy and 0.9892 ± 0.0014 macro-F1 on CICIoMT2024 19-class and 99.72 ± 0.04% accuracy on CICIoMT2024 binary (with the artefact features included the same pipeline saturates at 99.995–99.999%, which we report only as an artefact-driven upper bound), with consistent results on two cross-domain benchmarks (UNSW-NB15, CICIDS-2017) and sub-millisecond batched GPU inference latency (0.0129–0.0170 ms/sample). The static gates provide global feature rankings at zero inference cost, complementing per-sample post-hoc attribution methods such as SHAP. To our knowledge, HIFN-Mamba is the first IoMT IDS to combine learned information-theoretic regularisation with linear-time selective state-space modelling under an explicitly leakage-controlled nineteen-class IoMT evaluation.
SN - 2045-2322
ER -