Comparative Evaluation of Transformer, GNN, and Reinforcement Learning Models for Intrusion Detection in Internet of Medical Things

Abstract

The increasing prevalence of cyber threats across Internet of Medical Things (IoMT) ecosystems poses critical challenges for safeguarding patient safety and data integrity, necessitating a dynamic, resilient intrusion detection system (IDS). In this work, we present a comprehensive machine learning framework for classifying cyberattacks in IoMT settings using biometric and network traffic data from the publicly available WUSTL-EHMS-2020 dataset. We conduct a unique comparative analysis using three paradigms: a Graph Neural Network (GNN) model to capture structural dependencies; a Transformer deep learning model to capture contextual relationships; and a lightweight baseline classifier, Logistic Regression. We undertook extensive data preparation, including label encoding, normalisation, and stratified sampling to maintain class balance. The Transformer achieved the highest overall classification accuracy in the IoMT ecosystem (93.5%), outperforming both GNN (88.7%) and Logistic Regression (92.8%) across all evaluation metrics. Our research demonstrates the superior ability of attention-based models to identify complex threat patterns in heterogeneous IoMT data. Our study provides a reproducible benchmarking framework and lays the groundwork for future efforts related to hybrid modelling, explainable AI, and federated learning to improve the cybersecurity of Smart Healthcare Systems.