TriGuard: A CNN-BiLSTM-Attention Trinity for Robust IoMT Intrusion Detection

The Internet of Medical Things (IoMT) has revolutionized healthcare by enabling continuous patient monitoring and remote medical services. Nevertheless, IoMT devices are under high cybersecurity threats, which may affect patient safety and data integrity. This paper presents a novel hybrid deep learning architecture that combines Convolutional Neural Networks (CNN), Bidirectional Long Short-Term Memory (BiLSTM), and Multi-Head Attention mechanisms for enhanced IoMT intrusion detection. Our method learns local patterns by CNN layer, learns temporal patterns by BiLSTM, and pays special attention to important features by attention. Our model performs with 85.1% accuracy and 89.8% F1-score evaluated on CICIoMT2024 and 72.3% accuracy and 69.3% F1-score on CIC-BCCC-NRC TabularIoTAttack-2024, proving to be superior across both metrics and demonstrating a strong generalizability and transferability even when cross-dataset-optimized.