IoT Datasets Research Articles

Secure Data Deduplication With Dynamic Access Control for Mobile Cloud Storage

Data deduplication is of vital importance for mobile cloud computing to cope with the explosive growth of outsourced mobile data. In order to ensure the privacy of sensitive mobile data against an untrusted cloud, Message-Locked Encryption (MLE) has been proposed to enable deduplication over ciphertext. However, MLE prohibits data access control since it uses deterministic content-derived encryption keys. Recently, a lightweight rekeying-aware encrypted deduplication system (REED) has been proposed to achieve dynamic access control for secure data deduplication. However, REED is vulnerable to key-retaining attack and stub-retaining attack, which leads to insecure access revocation, and thus cannot support secure dynamic access control. In response, we present AC-Dedup, an encrypted deduplication storage system that supports <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">secure dynamic access control</i> for mobile cloud storage. At the core of AC-Dedup are two novel encryption techniques named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">mixed message locked encryption</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">random stub re-encryption</i> to resist the two types of attacks, respectively. To the best of our knowledge, AC-Dedup is the first practical system that achieves secure data deduplication and secure dynamic access control simultaneously. We conduct security analysis and experimental evaluation on mobile device and cloud platform with real-world IoT datasets. The results show that AC-Dedup enables secure and efficient dynamic access control while preserving deduplication effectiveness.

Enhancing Industrial IoT Security: Utilizing Blockchain-Assisted Deep Federated Learning for Collaborative Intrusion Detection

The Industrial Internet of Things (IIoT) is a rapidly evolving features with multiple applications, including critical infrastructure. Privacy policies are required to preserve the protection of user data in the threat intelligence community. Blockchain is a modern technology which used recently to provide more secure storage and efficiency. In this research, Blockchain Assisted Deep Federated Learning (BC_DFL) system is used to detect intruders. The three key processes used in the proposed intrusion detection architecture are data collection, pre-processing and intrusion detection. Data normalization, reduction, cleaning and transformation are used in pre-processing to remove extraneous information and improve data quality. This pre-processed data is sent to the Blockchain Assisted Deep Federated Learning (BC_DFL) system for intrusion detection. To detect intruders, the federated learning-based Capsule Auto-Encoder (FL_CAE) architecture first learns the properties from the inputs. Blockchain technology (BCTech) is not only used for storage but also improves security by eliminating the possibility of threatening node and individual server failure. The ToN_IoT and UNSW-NB15 data sets are used in the implementation and performance evaluation study. The proposed model is evaluated using existing in the Results section. In the UNSW-NB15 dataset, proposed model achieved an accuracy, precision, recall and F1 score of 97.26%, 97.28%, 96.89% and 96.96% respectively as well as in ToN_IoT data set proposed model achieved an accuracy, precision, recall and F1 score of 95.74%, 99.54 %, 99.49% and 99.24%, respectively. The execution of the proposed approach takes 2.31 seconds in the UNSW-NB15 dataset and 1.66 seconds in the ToN_IoT dataset. Blockchain offers a transparent and impenetrable ledger for transaction recording and verification. Within the framework of cooperative intrusion detection, it guarantees a secure and reliable exchange of threat intelligence and detection models between various users of IIoT ecosystem.

Network Attack Detection Using NeuroEvolution of Augmenting Topologies (NEAT) Algorithm

The imperfection of existing intrusion detection methods and the changing nature of malicious actions on the attacker's part led to the Internet of Things (IoT) network interaction in an unsafe state. The actual problem of improving the technology of the IOT is counteracting malicious network impacts. In this regard, research and development aimed at creating effective tools for solving applied problems within the framework of this problem are becoming increasingly important. This study seeks to develop tools for detecting anomalous network conditions resulting from malicious attacks. In particular, the accuracy of the identification of DoS and DDoS attacks is sufficient for operational use. This study analyzes various multi-level architectures, relevant communication protocols, and different types of network attacks. The presented research was conducted on open datasets TON_IOT DATASETS, which include multiple data sources collected from IoT sensors. The modified HyperNEAT algorithm was used as the basis for the development. The NEAT methodology used in the study allows you to combine various network nodes. Results of the study: a neuro-evolutionary algorithm for identifying DoS and DDoS attacks was implemented, integrated, and real-tested based on a multi-level analysis of network traffic combined with various adaptive modules. The accuracy of identifying DoS and DDoS attacks is 0.9242 in the Accuracy metric. The study implies that the proposed approach can be recommended for network intrusion detection, ensuring security when interacting with the IoT.

Predictive maintenance of vehicle fleets through hybrid deep learning-based ensemble methods for industrial IoT datasets

Abstract Connected vehicle fleets have formed significant component of industrial internet of things scenarios as part of Industry 4.0 worldwide. The number of vehicles in these fleets has grown at a steady pace. The vehicles monitoring with machine learning algorithms has significantly improved maintenance activities. Predictive maintenance potential has increased where machines are controlled through networked smart devices. Here, benefits are accrued considering uptimes optimization. This has resulted in reduction of associated time and labor costs. It has also provided significant increase in cost benefit ratios. Considering vehicle fault trends in this research predictive maintenance problem is addressed through hybrid deep learning-based ensemble method (HDLEM). The ensemble framework which acts as predictive analytics engine comprises of three deep learning algorithms viz modified cox proportional hazard deep learning (MCoxPHDL), modified deep learning embedded semi supervised learning (MDLeSSL) and merged LSTM (MLSTM) networks. Both sensor as well as historical maintenance data are collected and prepared using benchmarking methods for HDLEM training and testing. Here, times between failures (TBF) modeling and prediction on multi-source data are successfully achieved. The results obtained are compared with stated deep learning models. This ensemble framework offers great potential towards achieving more profitable, efficient and sustainable vehicle fleet management solutions. This helps better telematics data implementation which ensures preventative management towards desired solution. The ensemble method's superiority is highlighted through several experimental results.

Detecting cyberthreats in Metaverse learning platforms using an explainable DNN

The rapid integration of the Internet of Artificial Intelligence and Internet of Things (AI-IoT) technologies has given rise to a pivotal element of the upcoming digital era, the Metaverse. This confluence has significantly impacted virtual learning platforms by introducing enhanced, immersive, and interactive environments for learners, educators, and institutions. However, the growing reliance on Metaverse necessitates robust cybersecurity measures to detect and mitigate cyber threats and ensure the safety of users. This paper proposes an explainable deep neural network (DNN) designed to identify and address network intrusion attacks within Metaverse learning environments. By leveraging the latest cybersecurity IoT datasets and employing an effective feature selection method, this study provides a visually interpretable, trustworthy, and quantitative explanation of the network intrusion detection system (NIDS) model using Shapley Additive exPlanations (SHAP) and local interpretable model-agnostic explanation (LIME) explainability methods. The adopted explainable DNN, capable of processing network traffic features from interconnected Metaverse devices and IoT sensors, can facilitate accurate and comprehensible remediation of anomalous from benign activities within Metaverse. The NIDS model yields a high performing accuracy of 99.9% for establishing a more secure and trustworthy metaverse learning environment.

Personalized federated learning-based intrusion detection system: Poisoning attack and defense

To deal with the increasing number of cyber-attacks, intrusion detection system (IDS) plays an important role in monitoring and ensuring the security of the computer network. With the power of machine learning and deep learning, intelligent IDS systems have gained increasing attention due to their efficiency and high classification accuracy. However, the premise of machine learning/deep learning is that the data must be in one central entity (e.g., server) to train the model. This causes additional concerns, such as data transmission costs and privacy leakage. Federated learning complements this shortcoming with a privacy-preserving decentralized learning technique. In federated learning, the data are not shared with the server, local model training is performed where the data reside and only the model parameters are exchanged with the server. This work investigates the federated learning-based IDS approach in the context of IoT data to study the main challenges imposed by federated learning. Two main issues, such as data heterogeneity and poisoning attacks launched by malicious clients, are the main focus of this study. As real-world IoT datasets are heterogeneous, we propose a personalized federated learning-based IDS approach to handle imbalanced data distributions. Moreover, a curious yet malicious client can poison the local data or model to corrupt the global intrusion detection model due to the distributed nature of federated learning, where the central server has no control over the client’s local training process. This study demonstrates that the existence of a malicious client can degrade the performance of the federated learning-based IDS model. Accordingly, we propose a robust approach called pFL-IDS to combat poisoning attacks against the federated learning-enabled IDS on heterogeneous IoT data. Our approach introduces mini-batch logit adjustment loss to local model training to obtain a personalized model tailored to each local data distribution. Moreover, we design a detection mechanism at the server to identify malicious agents by considering the cosine similarity of local models from the non-poisoned client’s centroid. The non-poisoned centroid is determined from the similarity between the pre-computed global model and the local models. If the poisoning attack is successful, poisoned clients will be closer to the pre-computed global model; any models further from the pre-computed model are taken as the non-poisoned clients. With this two-phase client similarity alignment, we identify poisoned clients and restrict their aggregation on the global intrusion detection model. In comparison with the baseline methods, we demonstrate that our pFL-IDS can detect poisoning attacks without compromising performance.

An enhanced distributed framework for real-time performance testing of large scale IoT dataset using big data analytic tools

&lt;p&gt;The demand for analyzing enormous IoT datasets is rising in parallel with the popularity of the IoT. There are considerable obstacles to effective processing and analysis due to the amount, velocity, and variety of IoT data. In this research, we present a distributed system that makes use of big data analytic tools like Apache Hive, Spark, and Hadoop to efficiently test the performance of massive IoT datasets. The framework addresses the lack of a comprehensive solution by providing a scalable and fault-tolerant architecture. We discuss the motivation behind real-time performance testing in the context of big data analytics for IoT datasets and highlight the need for a distributed framework. A literature review is conducted to explore existing performance testing frameworks, big data analytic tools, and approaches for performance testing big data analytics. The proposed framework’s key components, including dataset generation, test scenario specification, cluster configuration, performance metrics collection, analysis and visualization modules, and implementation details, including tool choices, are discussed. An experimental evaluation is conducted to validate the framework’s performance, and it is suggested to incorporate blockchain technology. Overall, the proposed framework offers a comprehensive solution for real-time performance testing of large-scale IoT datasets, providing organizations and researchers with a valuable tool to ensure efficient and reliable IoT data processing and analysis.&lt;/p&gt;

Deep Autoencoder-Based Integrated Model for Anomaly Detection and Efficient Feature Extraction in IoT Networks

The intrusion detection system (IDS) is a promising technology for ensuring security against cyber-attacks in internet-of-things networks. In conventional IDS, anomaly detection and feature extraction are performed by two different models. In this paper, we propose a new integrated model based on deep autoencoder (AE) for anomaly detection and feature extraction. Firstly, AE is trained based on normal network traffic and used later to detect anomalies. Then, the trained AE model is employed again to extract useful low-dimensional features for anomalous data without the need for a feature extraction training stage, which is required by other methods such as principal components analysis (PCA) and linear discriminant analysis (LDA). After that, the extracted features are used by a machine learning (ML) or deep learning (DL) classifier to determine the type of attack (multi-classification). The performance of the proposed unified approach was evaluated on real IoT datasets called N-BaIoT and MQTTset, which contain normal and malicious network traffics. The proposed AE was compared with other popular anomaly detection techniques such as one-class support vector machine (OC-SVM) and isolation forest (iForest), in terms of performance metrics (accuracy, precision, recall, and F1-score), and execution time. AE was found to identify attacks better than OC-SVM and iForest with fast detection time. The proposed feature extraction method aims to reduce the computation complexity while maintaining the performance metrics of the multi-classifier models as much as possible compared to their counterparts. We tested the model with different ML/DL classifiers such as decision tree, random forest, deep neural network (DNN), conventional neural network (CNN), and hybrid CNN with long short-term memory (LSTM). The experiment results showed the capability of the proposed model to simultaneously detect anomalous events and reduce the dimensionality of the data.

A Systematic Review of Data-Driven Attack Detection Trends in IoT.

The Internet of Things is perhaps a concept that the world cannot be imagined without today, having become intertwined in our everyday lives in the domestic, corporate and industrial spheres. However, irrespective of the convenience, ease and connectivity provided by the Internet of Things, the security issues and attacks faced by this technological framework are equally alarming and undeniable. In order to address these various security issues, researchers race against evolving technology, trends and attacker expertise. Though much work has been carried out on network security to date, it is still seen to be lagging in the field of Internet of Things networks. This study surveys the latest trends used in security measures for threat detection, primarily focusing on the machine learning and deep learning techniques applied to Internet of Things datasets. It aims to provide an overview of the IoT datasets available today, trends in machine learning and deep learning usage, and the efficiencies of these algorithms on a variety of relevant datasets. The results of this comprehensive survey can serve as a guide and resource for identifying the various datasets, experiments carried out and future research directions in this field.

Federated Feature Selection for Horizontal Federated Learning in IoT Networks

Under horizontal federated learning (HFL) in IoT scenarios, different user datasets have significant similarities on the feature spaces, the final goal is to build a high-performance global model. However, not all features are great contributors when training the global HFL model, some features even impair the HFL. Besides, the curse of dimension will delay the training time and cause more energy consumption (EC). In this case, it is critical to remove irrelevant features from the local and select the useful overlapping features from a federated global perspective. In addition, the uncertainty of data being labelled and the non-independent and identically distributed (non-IID) client data should also consider. This paper introduces an unsupervised federated feature selection approach (named FSHFL) for HFL in IoT networks. First, a feature relevance outlier detection method is applied to the HFL participants to remove the useless features, which combines with the improved one-class support vector machine. Besides, a feature relevance hierarchical clustering (FRHC) algorithm is proposed for HFL overlapping feature selection. Experiment results on four IoT datasets show that the proposed methods can select better federated feature sets among HFL participants, thus improving the performance of the HFL system. Specifically, the global model accuracy improves up to 1.68% since fewer irrelevant features. Moreover, FSHFL can lower the average training time as high as 6.9%. Last, when the global model gets the same test accuracy, FSHFL can decrease the average EC of training the model by approximately 2.85% compared to Fed-Avg and roughly 68.39% compared to Fed-SGD.

Is There a Trojan! : Literature Survey and Critical Evaluation of the Latest ML Based Modern Intrusion Detection Systems in IoT Environments

IoT as a domain has grown so much in the last few years that it rivals that of the mobile network environments in terms of data volumes as well as cybersecurity threats. The confidentiality and privacy of data within IoT environments have become very important areas of security research within the last few years. More and more security experts are interested in designing robust IDS systems to protect IoT environments as a supplement to the more traditional security methods. Given that IoT devices are resource-constrained and have a heterogeneous protocol stack, most traditional intrusion detection approaches don’t work well within these schematic boundaries. This has led security researchers to innovate at the intersection of Machine Learning and IDS to solve the shortcomings of non-learning based IDS systems in the IoT ecosystem. Despite various ML algorithms already having high accuracy with IoT datasets, we can see a lack of sufficient production grade models. This survey paper details a comprehensive summary of the latest learning-based approaches used in IoT intrusion detection systems, and conducts a through critical review of these systems, potential pitfalls in ML pipelines, challenges from an ML perspective and discusses future research scope, and recommendations.

Secure Share: Optimal Blockchain Integration in IoT Systems

ABSTRACT Blockchain is an inherently secure technology, and incorporating it into IoT, will assist in enhancing IoT security. The proposed work focuses on establishing the blockchain’s viability for application in the Internet of Things to solve the trust issue. Due to the trust factor, publicly available IoT datasets are limited. First, various techniques proposed by researchers to adopt blockchain in IoT are discussed with their limitations. To overcome these limitations, the proposed work identified the optimal layer in a simplified three-tiered IoT architecture for incorporating blockchain to keep this integration lightweight. The challenges of storing all IoT data on the blockchain ledger are discussed. Finally, a blockchain-based secure data-sharing model is developed to trace the integrity of shared IoT data among its various IoT system stakeholders. The healthcare domain is being used to demonstrate the value of blockchain in IoT. Using blockchain for tracing the integrity of IoT data rather than storing all IoT data is an attempt to reduce the cost and complexity associated with Blockchain and IoT integration. It enables a trusted environment and promotes more availability of IoT datasets to the stakeholders.

Sea turtle foraging algorithm with hybrid deep learning-based intrusion detection for the internet of drones environment

The Internet of Drones (IoD) allows for coordinated control of airspace for Unmanned Aerial Vehicles (UAVs), also known as drones. The decreasing costs of processors, sensors, and wireless connectivity have made it possible to use UAVs in many variety of military to civilian applications. While most applications utilizing the drones in the IoD have been real-time related, users are now interested in obtaining real-time services from drones that are tailored to a specific fly zone. This study develops a Sea Turtle Foraging Algorithm with Hybrid Deep Learning-based Intrusion Detection (STFA-HDLID) as a algorithm that recognizes and categorizes intrusions in the IoD environment. For this purpose, it is necessary to implement data pre-processing to standardize the input data via min-max normalization. Additionally, the feature selection process is also based on the STFA. Finally, a Deep Belief Network (DBN) with a Sparrow Search Optimization (SSO) algorithm is used for classification. A comprehensive experimental analysis is performed on a benchmark dataset to demonstrate the performance of the STFA-HDLID, which achieves maximum accuracy of 99.51% and 98.85% on the TON_IoT and UNSW-NB15 datasets, respectively, outperforming other techniques.

Enhancement of an IoT hybrid intrusion detection system based on fog-to-cloud computing

Nowadays, with the proliferation of internet of things-connected devices, the scope of cyber-attacks on the internet of things has grown exponentially. So, it makes it a necessity to develop an efficient and accurate intrusion detection system that should be fast, dynamic, and scalable in an internet of things environment. On the other hand, Fog computing is a decentralized platform that extends Cloud computing to deal with the inherent issues of the Cloud computing. As well, maintaining a high level of security is critical in order to ensure secure and reliable communication between Fog nodes and internet of things devices. To address this issue, we present an intrusion detection method based on artificial neural networks and genetic algorithms to efficiently detect various types of network intrusions on local Fog nodes. Through this approach, we applied genetic algorithms to optimize the interconnecting weights of the network and the biases associated with each neuron. Therefore, it can quickly and effectively establish a back-propagation neural network model. Moreover, the distributed architecture of fog computing enables the distribution of the intrusion detection system over local Fog nodes with a centralized Cloud, which achieves faster attack detection than the Cloud intrusion detection mechanism. A set of experiments were conducted on the Raspberry Pi4 as a Fog node, based on the UNSW-NB15 and ToN_IoT data sets for binary-class classification, which showed that the optimized weights and biases achieved better performance than those who used the neural network without optimization. The optimized model showed interoperability, flexibility, and scalability. Furthermore, achieving a higher intrusion detection rate through decreasing the neural network error rate and increasing the true positive rate is also possible. According to the experiments, the suggested approach produces better outcomes in terms of detection accuracy and processing time. In this case, the proposed approach achieved an 16.35% and 37.07% reduction in execution time for both data sets, respectively, compared to other state-of-the-art methods, which enhanced the acceleration of the convergence process and saved processing power.

An Ensemble Tree-Based Model for Intrusion Detection in Industrial Internet of Things Networks

With less human involvement, the Industrial Internet of Things (IIoT) connects billions of heterogeneous and self-organized smart sensors and devices. Recently, IIoT-based technologies are now widely employed to enhance the user experience across numerous application domains. However, heterogeneity in the node source poses security concerns affecting the IIoT system, and due to device vulnerabilities, IIoT has encountered several attacks. Therefore, security features, such as encryption, authorization control, and verification, have been applied in IIoT networks to secure network nodes and devices. However, the requisite machine learning models require some time to detect assaults because of the diverse IIoT network traffic properties. Therefore, this study proposes ensemble models enabled with a feature selection classifier for Intrusion Detection in the IIoT network. The Chi-Square Statistical method was used for feature selection, and various ensemble classifiers, such as eXtreme gradient boosting (XGBoost), Bagging, extra trees (ET), random forest (RF), and AdaBoost can be used for the detection of intrusion applied to the Telemetry data of the TON_IoT datasets. The performance of these models is appraised based on accuracy, recall, precision, F1-score, and confusion matrix. The results indicate that the XGBoost ensemble showed superior performance with the highest accuracy over other models across the datasets in detecting and classifying IIoT attacks.

A Multi-Stage Automated Online Network Data Stream Analytics Framework for IIoT Systems

Industry 5.0 aims at maximizing the collaboration between humans and machines. Machines are capable of automating repetitive jobs, while humans handle creative tasks. As a critical component of Industrial Internet of Things (IIoT) systems for service delivery, network data stream analytics often encounter concept drift issues due to dynamic IIoT environments, causing performance degradation and automation difficulties. In this paper, we propose a novel Multi-Stage Automated Network Analytics (MSANA) framework for concept drift adaptation in IIoT systems, consisting of dynamic data pre-processing, the proposed Drift-based Dynamic Feature Selection (DD-FS) method, dynamic model learning & selection, and the proposed Window-based Performance Weighted Probability Averaging Ensemble (W-PWPAE) model. It is a complete automated data stream analytics framework that enables automatic, effective, and efficient data analytics for IIoT systems in Industry 5.0. Experimental results on two public IoT datasets demonstrate that the proposed framework outperforms state-of-the-art methods for IIoT data stream analytics.

A Survey of Public IoT Datasets for Network Security Research

Publicly available datasets are an indispensable tool for researchers, as they allow testing new algorithms on a wide range of different scenarios and making scientific experiments verifiable and reproducible. Research in IoT security is no exception. In particular, the design of traffic classification and intrusion detection solutions for network security relies on network traces obtained from real networks or realistic testbeds. In this paper, we provide a detailed survey on the existing datasets containing IoT network traffic. We classify them according to several features that help researchers quickly find the datasets that fit their specific needs. In total, we survey 74 datasets that we found by analyzing more than 100 scientific articles. We also discuss the weaknesses of existing datasets, identify challenges, and point to future directions for creating new IoT datasets.

USMD: UnSupervised Misbehaviour Detection for Multi-Sensor Data

Cyber-Physical Systems (CPSs) enable Information Technology to be integrated with Operation Technology to efficiently monitor and manage the physical processes of various critical infrastructures. Recent incidents in cyber ecosystems have shown that CPSs are becoming increasingly vulnerable to complex attacks. These incidents often lead to sensing and actuation misbehaviour by illegal manipulations of data, which can severely impact the underlying physical processes of critical infrastructures. Current research acknowledges that IT-based security measures cannot entirely protect CPSs from such threats. Moreover, they are not designed to monitor the measurement level activities of physical processes, and they fail to mitigate blended cyberattacks, especially multi-stage and zero-day ones. This article addresses these limitations by proposing a framework, named UnSupervised Misbehaviour Detection (USMD), comprising a deep neural network that learns about a system's expected behaviour from data-driven representations. USMD can identify in real-time the attacks on CPSs by using the long-short term memory and Attention method for multi-sensor data. The USMD's performance is evaluated on various known data sets (i.e., ToN_IoT, SWaT, WADI and Gas pipeline datasets). The experimental results indicate that the superior performance of USMD compared with six state-of-the-art methods, which we implemented and extensively tested. USMD achieves F-scores of 0.9699 and 0.9702 on SWaT and WADI datasets, respectively.

Framework of Geofence Service using Dummy Location Privacy Preservation in Vehicular Cloud Network

With the increasing prevalence of different mobile apps, many applications require users to enable the location service on their devices. For example, the geofence service can be defined as establishing virtual geographical boundaries. Enabling this service triggers entering and exiting the boundary area and notifies the users and trusted third parties. The foremost concern of using geofence is the privacy of location coordinates shared among different applications. In this paper, a framework called ‘TIET-GEO’ is proposed that allows users to define the geofence boundary; in addition, it monitors Global Positioning System (GPS) devices in real-time when they enter/exit a specific area. The proposed framework also proposes a dummy privacy preservation algorithm to generate K-dummy locations around the real trajectories when the user requests the Point Of Interest (POI) from the Location-Based Services (LBS). This article aims to enhance the location privacy preservation in geofence service, by generating a k-dummy location around the user location based on the radius size of the geofence area. The proposed framework uses token keys authentication to authorize the users in the Vehicular Cloud Network (VCN) service by generating secret token keys authentication between the client and services. The results obtained show the effectiveness of the proposed framework was on parameters like flexibility and reliability of responses from different sources, such as smart IoT devices and datasets.

Detection of Middlebox-Based Attacks in Healthcare Internet of Things Using Multiple Machine Learning Models.

The huge number of network traffic data, the abundance of available network features, and the diversity of cyber-attack patterns mean that intrusion detection remains difficult even though many earlier efforts have succeeded in building the Internet of Healthcare Things (IoHT). The implementation of an effective algorithm to filter out most of the probable outliers of Round Trip Time (RTT) of packets recorded in the Internet environment is urgently required. Congestion and interference in networks can arise when numerous biosensors in an IoHT system all attempt to communicate at once. Internet of Health Things networks are susceptible to both intra- and internetwork interference. In this research, the Server-Side Includes (SSI) attack is a key issue because it allows for network compromise as part of Internal Attacks. Despite recent advancements, SSI detection remains difficult due to the vast amounts of network traffic data, the abundance of network features, and the diversity of cyber-attack patterns (DDoS, DoS, Satan, spoofing, etc.). With the help of sensors, physiological data may be collected and sent to distant servers, where they can be analyzed in real time by doctors to help them catch diseases in their earliest stages. This is made possible by the Internet of medical things (IoMT). Wireless data transfer, however, leaves it vulnerable to hackers, especially if the data being transferred are particularly private or sensitive. Security measures designed for devices with more storage space and processing power will not work on those with less. However, machine learning for intrusion detection can give a tailored security response to the needs of IoMT systems. For SSI detection, current methods are either inefficient because of the large number of packets that need to be caught and analyzed or unsuccessful because of outlier values in the RTTs obtained from the captured TCP packets. To the same end, "downstream detection" refers to the process of calculating the total length of all connections made after a certain point. As a means of improving the SSI detection algorithm's throughput in a network environment, packet RTT outliers will be eliminated. Flow records are used as inputs by flow-based NIDS to determine whether or not a given flow is malicious. In order to detect middlebox-based attacks from two Medical Health IoT datasets, this paper proposes a unique architecture of explainable neural networks (XNN). The model's accuracy in classifying attacks in dataset 1 of the IoHT is 99.7%t, besides achieving 99.4% accuracy in categorising attacks on IoHT dataset 2.