A Hybrid CNN-Transformer Approach for Predicting Attack Severity in Electronic Health Monitoring Systems to Strengthen Cybersecurity
C A Bindyashree, Muzamil Basha Syed · Engineering Technology & Applied Science Research · 2025
Electronic Health Monitoring Systems (EHMS) have revolutionized patient care through continuous, connected monitoring. However, their pervasive connectivity exposes them to evolving cyber threats. In this context, for a resilient, real‑time Intrusion Detection System (IDS), we propose a novel hybrid Convolutional Neural Network–Transformer (CNN–Transformer) architecture that integrates the spatial feature extraction and long‑range sequence modelling functionality. The framework is trained on the publicly available WUSTL-EHMS-2020 network traffic dataset. The model features a dual-output head that simultaneously: (i) classifies attack types and (ii) predicts attack severity on a continuous scale. To address the dataset's severe class imbalance, the Synthetic Minority Oversampling Technique (SMOTE) is employed. Experimental results show the model achieves a classification accuracy of 83.33%, macro F1-score of 0.93, and Receiver Operating Characteristic Area Under the Curve (ROC-AUC) of 0.96, and severity regression achieves a Mean Absolute Error (MAE) of 0.3337 and an R2 0.89. Shapley Additive Explanations (SHAP) provide model interpretability, revealing packet length and inter-arrival time as key predictive features. The proposed IDS outperforms state‑of‑the‑art CNN, Long Short-Term Memory (LSTM), and ensemble baselines in the precision on minority classes. It is also computationally efficient, requiring only a single NVIDIA RTX 3080 Graphics Processing Unit (GPU) with <2 GB VRAM per batch, and delivers inference latency below 150 ms, meeting clinical real-time requirements. These findings make the hybrid CNN–Transformer a viable and deployment-ready approach to protect EHMS against cyber-attacks, in a scalable and explainable manner.