Interpretable and Adaptive GAN-BiLSTM Approach for Cyber Threat Detection in IoMT-based Healthcare 5.0.

Abstract

Healthcare 5.0, driven by the Internet of Medical Things (IoMT), introduces transformative changes in the medical field but also exposes systems to growing cybersecurity threats. While Deep Learning (DL) offers high accuracy in attack detection, its effectiveness is often limited by data imbalance and difficulty in identifying key features dynamically. Additionally, DL models are often criticized for their lack of interpretability, as their internal decisionmaking remains obscure. To overcome these limitations, this paper presents an explainable and adaptive DL-based security framework. It integrates a Generative Adversarial Network (GAN) to balance the dataset by generating realistic samples for underrepresented attack classes, and employs Bidirectional Long Short-Term Memory (BiLSTM) to identify temporal patterns and critical features. To enhance transparency, SHapley Additive exPlanations (SHAP) and Permutation Feature Importance (PFI) are used for interpreting the model's decisions. Experiments conducted on the NSL-KDD dataset demonstrate the effectiveness of the proposed method, achieving 93.81% accuracy and an F1-score of 82.95%.