Search papers, labs, and topics across Lattice.
This paper introduces IoMT-SecAlarmBench, a novel semi-synthetic benchmark designed to evaluate the detection of integrity attacks in the Internet of Medical Things (IoMT) by injecting controlled attacks into genuine ECG and PPG recordings. The structured experimental design incorporates various attack morphologies and severity levels, revealing that existing detection methods struggle significantly, particularly with replay attacks and low-amplitude transient spikes. Key findings indicate a critical trade-off between accurately detecting attacks and misclassifying sensor faults, with the best-performing detector exhibiting a high false-alarm rate on normal data.
Existing detectors fail to reliably distinguish between integrity attacks and sensor faults, with some methods performing at chance level on the most challenging cases.
The Internet of Medical Things (IoMT) combines clinical physiological data with cyber-system information, creating challenges in determining whether an abnormal reading reflects a genuine physiological event, a device fault, or a cyber-attack within the expected physiological range. Answering this requires counterfactual ground truth, which no existing dataset provides. We present IoMT-SecAlarmBench, a semi-synthetic benchmark that injects controlled integrity attacks into genuine coupled ECG+PPG recordings using a structured experimental design combining four attack morphologies, four severity levels, two physiological plausibility conditions, and replay attacks. Each injected window retains its cause, attack subtype, and the clean signal that would have been observed without the attack. We evaluate six detectors from five method families using threshold-independent measures and a matched false-alarm budget. Results show no method consistently detects the most difficult cases: replay attacks and low-amplitude transient spikes remain close to chance-level performance across detectors. Results also reveal a trade-off between detecting attacks and distinguishing them from sensor faults: the best-performing detector on hard cases flags fault/artifact windows at 5.3 times its false-alarm rate on normal data. Three-way classification performs poorly for genuine physiological events, and a leakage audit of a dual-modality network dataset indicates previously reported IoMT intrusion-detection performance is partly driven by identifying information. Benchmark, generation code, preprocessing, evaluation tools, and datasheet are released.
