Investigation of Augmented Datasets for Security in Internet of Medical Things (IoMT) Ecosystems

Abstract

This study investigates data augmentation as a strategy for addressing dataset scarcity in Internet of Medical Things (IoMT) cybersecurity and improving intrusion-detection system performance. Four augmentation methods—Rule-Based, Tabular Variational Autoencoder (TVAE), Conditional Tabular Generative Adversarial Network (CTGAN), and Gaussian Copula—were applied to two publicly available IoMT datasets (ECU-IoHT and WUSTL-EHMS) to generate augmented training data with differing class distributions and feature characteristics. Eleven machine learning algorithms were evaluated using Matthews Correlation Coefficient (MCC), F1-score, accuracy, and error-based metrics. Results showed consistent performance improvements across all evaluated models relative to the baseline datasets. The Rule-Based method produced the strongest overall results, achieving the highest MCC (0.9757), F1-score (99.19%), and accuracy (99.18%) with LightGBM, alongside low false-positive and false-negative rates. Among the generative approaches, TVAE delivered the strongest overall practical performance (F1-score = 96.94%, accuracy = 96.92%), while CTGAN achieved a marginally higher MCC (0.9047) and also produced competitive results with balanced class representation. Gaussian Copula generated the weakest overall outcomes, primarily due to highly skewed class distributions. Traditional models, such as Logistic Regression and Naive Bayes, recorded the largest relative gains, indicating that augmentation can substantially improve simpler classifiers in data-scarce environments. Overall, the findings demonstrate that augmentation quality depends not only on dataset expansion, but also on preserving class balance, feature diversity, and realistic traffic relationships. These results provide practical guidance for strengthening IoMT intrusion-detection systems in healthcare environments.

1. Introduction

1.1. Background to the Study

The prevalence and complexity of diseases have increased over time, placing growing pressure on traditional healthcare systems to deliver timely and effective services; the fact that patient numbers are continually rising, and that the required resources could be lacking to meet their needs, aggravates this further [1]. These difficulties have led to the recognition of using the Internet of Things (IoT) in delivering medical and healthcare services as a way to enhance them to satisfy consumer expectations.

The Internet of Medical Things (IoMT) integrates medical systems with IoT technologies and serves as a bridge between healthcare and digital innovation. Through real-time monitoring and data-driven medical treatments, IoMT devices—such as smart pacemakers, continuous glucose monitors, and wearable health trackers—improve patient care [2]. These technological advancements have improved healthcare delivery by enabling early anomaly detection, remote consultations, and automated treatment adjustments.

However, while IoMT devices increase connectivity and the quick exchange of data across patients and service providers, they are associated with several cybersecurity risks. According to Rahman & Jahankhani, IoMT devices are vulnerable to different cyberattacks, including Distributed Denial of Service (DDoS), Denial of Service (DoS), spoofing, and data injection attacks. As a result of these attacks, unauthorized access to patient records could occur, and healthcare services could also be disrupted [3]. Moreover, it could also result in life-threatening consequences if medical devices/records are manipulated.

Furthermore, Balhareth & Ilyas stated that existing IoMT security solutions are reliant on intrusion-detection systems (IDS) that are machine learning–based to identify cyber threats and mitigate their effects [4]. However, as stated by scholars like Naghib et al., these existing datasets—like ECU-IoHT and WUSTL-EHMS—are not well-equipped with the capability to adapt to the ever-evolving trend of cyberattacks, and do not have sufficient diversity in their device logs [5]. These shortfalls limit the efficiency of current IoMT security solutions and make IoMT environments prone to present and future cyberattacks. According to Alturki et al., the limitations of existing IoMT security solutions have rendered them rigid, inefficient, and insufficient for handling the dynamic nature of IoMT environments because the number of patients using these devices is bound to increase, and so will the risks of cyberattacks [6].

Unlike prior IoMT intrusion-detection studies that typically evaluate isolated models or single-augmentation methods, this work provides a unified comparative benchmark of four augmentation strategies across eleven classifiers using imbalance-aware metrics. It further contrasts feature-enrichment augmentation with generative augmentation under varying dataset distributions.

Thus, to enhance IoMT security, developing enriched datasets is crucial, as they would have the capacity to deal with a wide scope of cybersecurity risks, while also being capable of handling the dynamic nature of IoMT devices in diverse medical environments.

1.2. Problem Statement

Healthcare provision has undergone significant changes within the last few years as a result of technological advancements and the Internet of Things. Consequently, medical devices are now interconnected, where real-time exchange of data is now possible across these devices. However, these developments also introduce new security challenges, which can negatively affect the privacy of patient data, the device integrity, and the healthcare system as a whole.

Scholars and researchers who have carried out many studies to try to manage these hazards have drawn significant attention to these security issues. Although their research has been commendable and has made major advances, current datasets are marked by a limited variety of attack scenarios, which consequently limit the efficiency of the IDS in identifying and improving resistance against current and emerging cyber threats.

This research seeks to address existing gaps in available datasets by generating enriched datasets, leveraging existing IoMT datasets. This study aimed to guarantee a more balanced dataset distribution to improve the robustness of IDS models in identifying and suppressing modern security threats in IoMT ecosystems and also help promote the development of more resilient and adaptable security solutions for healthcare environments.

1.3. Aim and Objectives of the Study

This study aims to investigate the application of augmented datasets for Internet of Medical Things (IoMT) ecosystem security.

The study’s specific objectives are to:

• Generate new datasets that capture several cyber threats targeting IoMT systems by augmenting existing datasets;
• Evaluate how augmented datasets improve the performance of machine learning algorithms relative to the existing datasets;
• Conduct a comparative analysis of augmentation techniques to identify optimal strategies for IoMT threat detection.

2. Related Works

Table 1. The literature review summary.

Authors	Title	Methodology	Strengths	Weaknesses	Remarks
Nasayreh et al. (2025) [7]	Automated Detection of Cyberattacks in Healthcare Systems	KNN for classification, LSTM for feature extraction and PCA for feature selection	Cyber threat mitigation in healthcare environments	Lacks an enriched dataset that covers a wide range of cyberattacks	Highlights the necessity for an enriched dataset
Ali et al. (2025) [8]	Deep Learning vs. Machine Learning for Intrusion Detection in Computer Networks	Various ML techniques for IDS	Able to recognize novel threats and adapt to evolving cyberattacks	Evolving threats, complex and high-dimensional data	Justifies the need for data diversity
Kadam & Verma (2025) [9]	Evaluating Effectiveness: A Critical Review of Performance Metrics in Intrusion Detection System	Analysis of IDS performance metrics, such as accuracy, precision, specificity, recall, and F1-score	Clarifies importance of multiple metrics for IDS performance	Some metrics lack realistic insight	Highlights need for robust evaluation
Balhareth & Ilyas (2024) [4]	Optimized Intrusion Detection for IoMT Networks with Tree-Based Machine Learning and Filter-Based Feature Selection	Machine learning, feature selection	Improves detection accuracy with feature engineering	Limited dataset comprehensiveness	Justifies dataset expansion
Areia et al. (2024) [10]	IoMT-TrafficData: Dataset and Tools for Benchmarking Intrusion Detection in Internet of Medical Things	Dataset benchmarking	Provides structured traffic analysis	Lacks attack diversity and real-world applicability	Supports dataset merging and attack simulations
Si-Ahmed et al. (2024) [11]	Explainable Machine Learning-Based Security and Privacy Protection Framework for Internet of Medical Things Systems	Dataset analysis	Catalogues existing datasets for IDS evaluation	Many datasets lack modern attack representation	Supports dataset enhancement
Hernandez-Jaimes et al. (2023) [12]	Artificial Intelligence for IoMT Security: A Review of Intrusion Detection Systems, Attacks, Datasets and Cloud–Fog–Edge Architectures. Internet of Things	Systematic review	Acknowledges IoMT’s positive impact and security risks	Traditional IDS models remain ineffective	Reinforces the need for advanced detection schemes
Vijayakumar et al. (2023) [13]	Enhanced Cyberattack Detection Process for Internet of Health Things (IoHT) Devices using a Deep Neural Network. Processes	Threat analysis	Identifies protocol-specific exploits	Dataset lacks diversity in attacks	Highlights the need for comprehensive datasets
Dwivedi et al. (2022) [14]	Potential of Internet of Medical Things (IoMT) Applications in Building a Smart Healthcare System: A Systematic Review. Journal of Oral Biology and Craniofacial Research	Conceptual analysis	Highlights IoMT’s adoption and applications	Security challenges remain unresolved	Emphasizes IDS importance
Tauqeer et al. (2022) [15]	Cyberattacks Detection in IoMT using Machine Learning Techniques. Journal of Computing & Biomedical Informatics	Dataset benchmarking	Provides insights into hospital network security	Lacks broad cyberattack coverage	Reinforces IDS generalization needs
Hameed et al. (2021) [16]	A Hybrid Lightweight System for Early Attack Detection in the IoMT Fog	IDS framework development	Efficient real-time attack detection	Dataset needs more IoMT-specific attacks	Justifies dataset enrichment
Saheed & Arowolo (2021) [17]	Efficient Cyber Attack Detection on the Internet of Medical Things-Smart Environment Based on Deep Recurrent Neural Network and Machine Learning Algorithms	Deep learning (DRNN)	Effective for complex threats	Limited by the dataset structure and diversity	Supports deep learning applications in IDS
Rahman & Jahankhani (2021) [3]	Security Vulnerabilities in Existing Security Mechanisms for IoMT and Potential Solutions for Mitigating Cyber-Attacks	Security threat analysis	Identifies key vulnerabilities like weak encryption	Lacks proposed mitigation strategies	Reinforces the need for IDS
Alsaedi et al. (2020) [18]	A New Generation Dataset of IoT and IIoT for Data-Driven Intrusion Detection Systems	Dataset analysis	Comprehensive device and network data	Does not focus on IoMT-specific attacks	Needs IoMT-tailored datasets
Zhao (2020) [19]	Prediction Model and Risk Scores of ICU Admission and Mortality in COVID-19	Security dataset analysis	Highlights critical ICU vulnerabilities	Outdated threat models	Requires modern dataset updates

below is a brief outline of some key papers that were in scope of this study. This summarizes the authors, the name of the publications, the research procedures employed, the advantages and/or shortcomings of the research, and a review of why this research needs to be carried out. As seen in Table 1, various studies have been undertaken to determine the ways in which IoMT environments can be made secure. Nevertheless, they have not emphasized the creation of an enhanced dataset by augmenting existing datasets in their studies.

The reviewed literature indicates that, in recent years, extensive research has focused on the evaluation and propositions of strategies for improving security in IoMT ecosystems. For instance, Nasayreh et al. [7] proposed KNN for classification, LSTM for feature extraction, and PCA for feature selection when building an IDS. Nonetheless, the approach does not have an enriched dataset to cover a wide range of cyberattacks. Tauqeer et al. made it clear that the benchmarking of datasets must be implemented; however, this method has limitations since it cannot provide a wide range of cyberattacks [15]. According to Alsaedi et al., Rahman & Jahankhani, and Zhao, security analysis of the dataset is necessary [3,18,19]. This approach can reveal pressing ICU vulnerabilities, including weak encryption, a lack of IoMT-specific attacks, and the absence of mitigation strategies.

The limitations of the approaches suggested by various researchers indicate major research gaps in the realization of a secure IoMT environment. As such, this leads to the necessity of conducting additional studies to address these gaps by proposing and testing IoMT environment security solutions using augmented datasets. Consequently, this study aims to address these gaps by generating a new dataset that captures several cyber threats targeting IoMT systems through augmenting existing datasets, leveraging a machine learning model for intrusion detection in healthcare with the newly generated dataset, and evaluating the proposed model using appropriate performance metrics by comparing the newly augmented dataset with the existing datasets.

3. Materials and Methods

This is an experimental research design. It implies combining and expanding various datasets on the security of the IoMT to form enhanced datasets to assess and enhance the identification of wider cyber threats in the IoMT setting. The research used publicly available datasets of IoMT security (like ECU-IoHT and WUSTL-EHMS), including both normal and attack traffic records, which guarantee a variety of device types, attack scenarios, and characteristics. There was preprocessing and standardization of the choice of datasets. Various data augmentation methods, such as Rule-Based, Tabular Variational Autoencoder (TVAE)-based, Conditional Tabular Generative Adversarial Network (CTGAN)-based, and Gaussian Copula–based, were tried to produce new, enriched datasets. The Gaussian Copula was used to independently address class imbalance in the datasets. It compared the original, augmented, and merged datasets to measure improvements in intrusion-detection performance. Several machine learning models were trained and assessed on the original and the augmented datasets. The efficacy of every dataset and augmenting method was measured through extensive measures. To identify which augmentation technique functions better in enhancing intrusion detection in the IoMT settings, a comparative analysis was done to identify the best-performing augmentation technique. Figure 1 illustrates the architecture of the dataset augmentation framework for IoMT security, with the corresponding synthetic data generation and model evaluation procedures detailed in Algorithm 1 and Algorithm 2, respectively.

The area covered by the research provided is the creation and expansion of publicly available datasets on IoMT, including ECU-IoHT or WUSTL-EHMS. To diversify the cyber threat scenarios represented in the dataset, data augmentation tools were employed. Moreover, this research paper involves the adoption and training of some applicable machine learning models that can be used in the detection of intrusion using the proposed enriched datasets. It more specifically concentrates on supervised learning methods that are able to detect normal and suspicious activities within the context of the IoMT. The performance of the models trained on the enriched dataset was also compared to the models trained on each of the individual IoMT datasets, in an attempt to determine the performance of the enriched dataset compared to the available datasets.

All experiments were implemented in Python 3.12.1 (Python Software Foundation) and executed in Visual Studio Code. Data manipulation and numerical computations were performed using Pandas 2.3.1 and NumPy 2.3.2, respectively. Data augmentation was conducted using the Synthetic Data Vault (SDV) library version 1.24.1, which provided the GaussianCopulaSynthesizer, TVAESynthesizer, and CTGANSynthesizer implementations. Machine learning models were built and evaluated using Scikit-learn 1.7.2, with additional gradient boosting implementations provided by XGBoost 3.0.3, CatBoost 1.2.8, and LightGBM 4.6.0. Model persistence was handled using Joblib, included as part of the Scikit-learn distribution. All visualizations were generated using Matplotlib 3.10.5.

3.1. Synthetic Dataset Generation Algorithm

Input (D): Base datasets from ECU-IoHT.csv and wustl-ehms.csv;

Output (R): High-quality synthetic IoMT datasets with augmentation analysis.

Algorithm 1: Synthetic Data Generation Algorithm

1. Load datasets D       2. Define       3.           Attack types = {ARP Spoofing, Nmap Port Scan, Smurf Attack, DoS Attack}       4.           Augmentation models M = {TVAE, Gaussian Copula, CTGAN}       5. Feature Engineering       6.           Label: 1 if attack, else 0; Type: attack name or “normal”; Duration: Time.diff()       7. Combine datasets D_combined = concat(base_features, additional_features)       8. Data Cleaning       9.           Fill missing values with random sampling from non-null values       10.         Remove duplicates       11. Preprocess data D_processed = preprocess(D_combined)       12.         Convert Label to categorical       13.         Identify numerical/categorical columns       14. Initialize metadata from D_processed       15. For each model m ∈ M:       16.         Train model m.fit(D_processed) with epochs = 1000, batch_size = 1000       17.         Generate synthetic data D_syn = m.sample(num_samples)       18.         Postprocess D_syn → restore original dtypes, enforce Label consistency       19.         Quality evaluation quality_report = evaluate_quality(D_combined, D_syn)       20.         Save D_syn.to_csv(f”synthetic_data_{m}.csv”)       21. Return: Quality reports + synthetic datasets for all models → R

3.2. Model Training and Performance Evaluation Algorithm

Input (D): Base datasets from ECU-IoHT and WUSTL-EHMS, augmented datasets;

Output (R): High-quality synthetic IoMT datasets with augmentation analysis.

Algorithm 2: Model Evaluation Algorithm

1. Load datasets D = {ECU-IoHT, WUSTL-EHMS, Synthetic datasets}       2. Define models M = {RF, XGBoost, SVM, LightGBM, CatBoost, KNN, MLP, LR, AdaBoost, GradientBoost, NaiveBayes}       3. For each dataset d ∈ D:       4.           Data Preparation: Train–test split (80/20), handle missing values       5.           Augmentation: Generate synthetic samples using Gaussian Copula to balance classes on train partition       6.           Feature Engineering: Hash Source/Destination (16 dims), encode Protocol       7. For each model m ∈ M:       8.           Hyperparameter tuning: GridSearchCV with 5-fold StratifiedCV → m_best       9.           Train and save m_best.fit(X_train, y_train)       10.         Predict: y_pred, y_proba = m_best.predict(X_test)       11.         Compute metrics: Accuracy, Precision, Recall, F1, MCC, Kappa, AUC, FPR, FNR, FDR, NPV, Log Loss       12. Visualize: Confusion matrices, learning curves, performance comparisons       13. Export: Save results to Excel, generate plots       14. Return: Trained models + metrics + visualizations → R

It is important to note that the synthetic datasets were generated independently in a separate pipeline prior to any train–test splitting, and were treated as standalone datasets during evaluation. No augmentation was applied to the test partition at any stage, ensuring that reported performance gains reflect genuine generalization improvement rather than in-distribution memorization.

4. Results

This chapter evaluates the efficacy of the generated datasets by measuring the performance of intrusion-detection systems trained on each dataset, demonstrating their adaptability in building highly confident intrusion-detection systems for Internet of Medical Things (IoMT) environments. The assessment includes a comparison between the application of traditional machine learning techniques, with ensemble learning techniques and neural networks, to determine their performance on both existing and augmented datasets.

4.1. Existing Dataset Distribution

The ECU-IoHT dataset was the largest source of traffic that had 111,207 records, as illustrated in Figure 2 [20]. It has a relatively small feature space (eight features), though a large number of labeled attacks (87,754), and 23,453 normal instances. It has four unique attacks—Smurf Attack, Nmap Port Scan, ARP Spoofing, and DoS Attack—making it a good source of attack variety.

The WUSTL-EHMS dataset offers a compromise between size and characteristics, as it has 16,318 records and 45 features. It provides a realistic traffic pattern, comprising 2046 attack records and 14,272 normal records, covering two attack categories: data alteration and spoofing. This particularly represents model performance in uncommon situations of IoT-enabled hospitals.

4.2. Augmented Dataset Distribution

Unlike the generative augmentation methods, the Rule-Based approach does not synthesize new records. Instead, as described in Algorithm 1 (Step 7), it enriches the ECU-IoHT dataset by concatenating eight behavioral network features extracted from WUSTL-EHMS, with missing values imputed by random sampling from the empirical distribution of each feature column. This feature enrichment strategy preserves the original record count and label distribution while substantially expanding the feature space available to classifiers. As Figure 3 shows, the Rule-Based enhanced dataset was able to represent attacks significantly and cover all the patterns of a real IoT healthcare network. The dataset contains 111,207 aggregate instances with 78.9% attack instances versus 21.1% normal instances.

The CTGAN-based augmentation had a better balance of classes than the Rule-Based method by producing synthetic instances via adversarial learning that retained the realistic nature of IoT traffic. This average imbalance offers a good training regime to form intrusion-detection models that balance the sensitivity to threats and minimization of false positives, appropriate to healthcare IoT devices that need security and value in operational efficiency. Figure 4 shows the distribution of the resulting dataset, which has 107,673 total instances.

The augmentation method based on TVAE was capable of generating an augmented dataset that is statistically consistent and provides a decent representation of attacks. Figure 5 demonstrates the outcome of applying the variational autoencoder to create different patterns of the IoT healthcare traffic. The augmented dataset has a total of 94,443 instances, with 77.9% and 22.1% attack and normal instances, respectively. The TVAE-based method produced data focused on attacks that are well-represented by probabilistic modeling. The method minimized the size of the entire dataset by 12.3% of the CTGAN-based dataset, without rejecting attack classes. The use of a probabilistic modeling approach made sure that the synthetic instances had a realistic distribution of features while exploring diverse variations in threat patterns in the IoT healthcare environment.

The most attack-concentrated environment was developed under the Gaussian Copula augmentation method, with 89.3% representation of attacks across the entire 82,397 instances. This extreme imbalance reflects a fundamental characteristic of copula-based generation—the Gaussian Copula models the joint statistical distribution of the source data, which already contained a higher proportion of attack records. Generating synthetic samples from this learned distribution naturally amplifies the existing imbalance rather than correcting it, resulting in a dataset where attack patterns are richly represented, but normal traffic is structurally under-represented from the point of generation. Notably, the same number of synthetic samples was generated for TVAE and CTGAN, yet those methods produced more balanced distributions of 77.9% and 58% attacks, respectively, highlighting that the extreme imbalance in the Gaussian Copula dataset is a consequence of how the copula learns and replicates dependency structures from skewed source data rather than a sampling quantity issue. While the high attack concentration provides an ideal training setting for models with the highest sensitivity to cybersecurity threats, it also introduces practical constraints on model generalization that are reflected in the performance results. Figure 6 presents the label distribution of the Gaussian Copula–augmented dataset.

4.3. Dataset-Specific Performance Metrics Analysis

In this section, the complete analysis of the performance of the machine learning algorithms is performed on all datasets created during this research. It systematically analyzes the effectiveness of the eleven machine learning algorithms on cybersecurity threat detection in IoMT environments across four augmentation strategies—Rule-Based, CTGAN, TVAE, and Gaussian Copula—alongside the two original baseline datasets.

The unique class distributions and synthetic data characteristics present in each dataset generate different learning environments that expose the strengths and weaknesses of each algorithm. To ensure a comprehensive and consistent evaluation, twelve performance metrics are reported across all dataset configurations in

Table 2. Performance metrics of benchmark models on ECU-IoHT dataset.

Model	Acc	Prec	NPV	Recall	F1-Score	MCC	Kappa	AUC	FPR	FNR	FDR	Log_Loss
Random Forest	0.9623	0.9627	0.9553	0.9623	0.9621	0.9198	0.919	0.9912	0.0146	0.0757	0.0252	0.1039
XGBoost	0.9655	0.966	0.9574	0.9655	0.9653	0.9268	0.9259	0.9921	0.0114	0.0723	0.0199	0.0966
SVM	0.9356	0.9356	0.948	0.9356	0.9356	0.863	0.863	0.9663	0.0516	0.0854	0.0849	0.2666
LightGBM	0.9647	0.965	0.9582	0.9647	0.9645	0.9249	0.9242	0.9921	0.0139	0.0706	0.0239	0.0939
CatBoost	0.9662	0.9667	0.9577	0.9662	0.966	0.9282	0.9273	0.9923	0.0107	0.0718	0.0187	0.0935
KNN	0.956	0.956	0.9564	0.956	0.9559	0.9063	0.906	0.9725	0.0263	0.0729	0.0446	0.7325
MLP	0.8923	0.8997	0.8652	0.8923	0.8891	0.7737	0.7608	0.9441	0.0208	0.2506	0.0436	0.3005
Logistic Regression	0.7628	0.7635	0.7611	0.7628	0.7516	0.4803	0.464	0.8461	0.0988	0.4647	0.2327	0.4721
AdaBoost	0.958	0.958	0.9575	0.958	0.9578	0.9104	0.9101	0.9856	0.0243	0.0712	0.0412	0.5294
Gradient Boosting	0.9651	0.9655	0.958	0.9651	0.9649	0.9258	0.9251	0.992	0.0128	0.0712	0.0222	0.0974
Naive Bayes	0.7692	0.7705	0.7661	0.7692	0.7586	0.4954	0.4791	0.8318	0.095	0.4539	0.2222	0.5097

,

Table 3. Performance metrics of benchmark models on WUSTL-EHMS dataset.

Model	Acc	Prec	NPV	Recall	F1-Score	MCC	Kappa	AUC	FPR	FNR	FDR	Log_Loss
Random Forest	0.8336	0.8514	0.9205	0.8336	0.8415	0.329	0.326	0.7636	0.1141	0.524	0.6214	0.3906
XGBoost	0.8309	0.851	0.9208	0.8309	0.8397	0.3266	0.323	0.7708	0.118	0.5192	0.6269	0.4505
SVM	0.8713	0.8671	0.9215	0.8713	0.8691	0.4022	0.4018	0.7779	0.0681	0.5433	0.5052	0.4972
LightGBM	0.8263	0.849	0.9201	0.8263	0.8362	0.3169	0.3128	0.7729	0.1229	0.5216	0.6375	0.4014
CatBoost	0.8275	0.8491	0.9199	0.8275	0.837	0.3177	0.3139	0.7717	0.1211	0.524	0.6354	0.3878
KNN	0.8229	0.8488	0.9207	0.8229	0.834	0.3151	0.31	0.7178	0.1278	0.5144	0.6431	1.5465
MLP	0.8156	0.8467	0.9203	0.8156	0.8287	0.3041	0.2976	0.758	0.1366	0.512	0.6571	0.4275
Logistic Regression	0.8747	0.8695	0.9221	0.8747	0.8719	0.4126	0.4119	0.7535	0.0646	0.5409	0.4907	0.5169
AdaBoost	0.8346	0.8508	0.9196	0.8346	0.8418	0.3266	0.3241	0.7362	0.112	0.5312	0.6206	0.5793
Gradient Boosting	0.8287	0.8492	0.9197	0.8287	0.8378	0.3186	0.315	0.7665	0.1194	0.5264	0.6331	0.3869
Naive Bayes	0.8575	0.8597	0.9206	0.8575	0.8586	0.3693	0.3692	0.6854	0.0843	0.5409	0.5568	0.5304

,

Table 4. Performance metrics of benchmark models on Rule-Based augmented dataset.

Model	Acc	Prec	NPV	Recall	F1-Score	MCC	Kappa	AUC	FPR	FNR	FDR	Log_Loss
Random Forest	0.991	0.9912	0.9656	0.991	0.991	0.9732	0.973	0.999	0.0077	0.0094	0.0021	0.0295
XGBoost	0.9914	0.9915	0.967	0.9914	0.9914	0.9744	0.9742	0.9991	0.0073	0.009	0.0019	0.0263
SVM	0.9786	0.979	0.9371	0.9786	0.9788	0.9364	0.9363	0.9945	0.037	0.0172	0.0099	0.069
LightGBM	0.9918	0.992	0.9685	0.9918	0.9919	0.9757	0.9756	0.9991	0.0066	0.0086	0.0018	0.0904
CatBoost	0.9916	0.9918	0.9673	0.9916	0.9917	0.9752	0.975	0.9992	0.0062	0.0089	0.0017	0.0255
KNN	0.971	0.9713	0.9214	0.971	0.9711	0.9133	0.9132	0.9931	0.058	0.0213	0.0155	0.1617
MLP	0.9804	0.9804	0.9545	0.9804	0.9804	0.9409	0.9409	0.9947	0.048	0.0121	0.0127	0.0895
Logistic Regression	0.9172	0.9322	0.7356	0.9172	0.9208	0.7848	0.7742	0.955	0.0542	0.0904	0.0156	0.2188
AdaBoost	0.9865	0.9867	0.9565	0.9865	0.9865	0.9597	0.9596	0.998	0.0199	0.0118	0.0053	0.4278
Gradient Boosting	0.9915	0.9917	0.9663	0.9915	0.9915	0.9748	0.9747	0.999	0.0058	0.0092	0.0015	0.0277
Naive Bayes	0.9152	0.9323	0.7268	0.9152	0.9191	0.7832	0.7707	0.9695	0.0452	0.0954	0.0131	0.4918

,

Table 5. Performance metrics of benchmark models on CTGAN-augmented dataset.

Model	Acc	Prec	NPV	Recall	F1-Score	MCC	Kappa	AUC	FPR	FNR	FDR	Log_Loss
Random Forest	0.9526	0.9531	0.9427	0.9526	0.9524	0.9027	0.9018	0.9857	0.0218	0.0832	0.0322	0.1391
XGBoost	0.9537	0.954	0.9463	0.9537	0.9535	0.9047	0.9041	0.9876	0.0241	0.0774	0.0353	0.1265
SVM	0.9275	0.9274	0.9314	0.9275	0.9274	0.8505	0.8504	0.9677	0.0548	0.0973	0.0782	0.2266
LightGBM	0.9535	0.9538	0.9466	0.9535	0.9533	0.9043	0.9037	0.9873	0.0249	0.0768	0.0363	0.1272
CatBoost	0.9532	0.9536	0.9457	0.9532	0.9531	0.9039	0.9032	0.9871	0.0241	0.0784	0.0353	0.1276
KNN	0.9238	0.9237	0.9263	0.9238	0.9236	0.8428	0.8426	0.9674	0.0557	0.105	0.08	0.4752
MLP	0.9465	0.9466	0.9439	0.9465	0.9464	0.8898	0.8895	0.9826	0.0343	0.0803	0.0496	0.1495
Logistic Regression	0.8456	0.847	0.8364	0.8456	0.8437	0.6809	0.6765	0.919	0.0861	0.2499	0.1383	0.3385
AdaBoost	0.9292	0.9305	0.9147	0.9292	0.9287	0.8548	0.8526	0.9774	0.0311	0.1264	0.0474	0.5338
Gradient Boosting	0.9517	0.9519	0.9453	0.9517	0.9515	0.9006	0.9	0.9871	0.0266	0.0787	0.0388	0.1292
Naive Bayes	0.8566	0.8609	0.8357	0.8566	0.854	0.7057	0.6976	0.9023	0.0616	0.2579	0.1039	0.4669

,

Table 6. Performance metrics of benchmark models on TVAE-augmented dataset.

Model	Acc	Prec	NPV	Recall	F1-Score	MCC	Kappa	AUC	FPR	FNR	FDR	Log_Loss
Random Forest	0.9667	0.9681	0.8825	0.9667	0.9671	0.8942	0.8933	0.9936	0.0523	0.029	0.0122	0.0822
XGBoost	0.9685	0.9693	0.8966	0.9685	0.9688	0.8987	0.8983	0.9942	0.06	0.0249	0.0139	0.0754
SVM	0.9359	0.949	0.7538	0.9359	0.9388	0.8211	0.8103	0.9771	0.025	0.0731	0.0062	0.1694
LightGBM	0.9692	0.9699	0.8999	0.9692	0.9694	0.9005	0.9002	0.9942	0.0605	0.024	0.014	0.0759
CatBoost	0.968	0.9688	0.8958	0.968	0.9683	0.8969	0.8965	0.9943	0.0622	0.0251	0.0144	0.0756
KNN	0.9397	0.9486	0.7763	0.9397	0.9419	0.8239	0.8172	0.9805	0.0491	0.0629	0.0119	0.2716
MLP	0.962	0.9645	0.8607	0.962	0.9627	0.8814	0.8797	0.9907	0.0496	0.0353	0.0117	0.0989
Logistic Regression	0.9014	0.9184	0.6801	0.9014	0.9062	0.7206	0.71	0.9555	0.1089	0.0962	0.0269	0.2656
AdaBoost	0.9574	0.9591	0.8601	0.9574	0.958	0.8644	0.8636	0.9884	0.078	0.0344	0.0182	0.5422
Gradient Boosting	0.9679	0.9686	0.8964	0.9679	0.9681	0.8963	0.896	0.994	0.0639	0.0248	0.0148	0.0776
Naive Bayes	0.907	0.9337	0.6734	0.907	0.913	0.7599	0.7388	0.9636	0.0255	0.1085	0.0065	0.6057

and

Table 7. Performance metrics of benchmark models on Gaussian Copula–augmented dataset.

Model	Acc	Prec	NPV	Recall	F1-Score	MCC	Kappa	AUC	FPR	FNR	FDR	Log_Loss
Random Forest	0.7965	0.9068	0.3216	0.7965	0.8311	0.4318	0.3679	0.8947	0.1654	0.208	0.0241	0.4163
XGBoost	0.8019	0.9077	0.3281	0.8019	0.8351	0.4389	0.3765	0.8956	0.1648	0.202	0.0238	0.4118
SVM	0.8573	0.9006	0.3986	0.8573	0.8732	0.4508	0.4288	0.8863	0.3102	0.1229	0.0401	0.4829
LightGBM	0.7993	0.9075	0.3252	0.7993	0.8332	0.4364	0.3729	0.8961	0.1631	0.2052	0.0237	0.4105
CatBoost	0.8013	0.9084	0.3281	0.8013	0.8348	0.441	0.3774	0.8964	0.1591	0.2034	0.023	0.4102
KNN	0.7598	0.889	0.2697	0.7598	0.8021	0.343	0.2853	0.8257	0.2539	0.2386	0.0379	0.76
MLP	0.8064	0.9061	0.3314	0.8064	0.8382	0.4362	0.3782	0.8897	0.1821	0.1949	0.026	0.4096
Logistic Regression	0.8515	0.9013	0.3887	0.8515	0.8694	0.4496	0.4233	0.8721	0.2918	0.1316	0.0382	0.4729
AdaBoost	0.7952	0.9058	0.3192	0.7952	0.83	0.4272	0.3639	0.8936	0.1712	0.2088	0.0249	0.5567
Gradient Boosting	0.802	0.9078	0.3283	0.802	0.8352	0.4393	0.3769	0.896	0.1643	0.202	0.0237	0.4119
Naive Bayes	0.7907	0.8937	0.3016	0.7907	0.8251	0.379	0.3284	0.8244	0.2545	0.2039	0.0364	0.5346

. These metrics are defined as follows: accuracy (Acc) measures the overall proportion of correct classifications; precision (Prec) captures how many predicted attacks are true attacks, reflecting false alarm control; Negative Predictive Value (NPV) measures how reliably the model identifies normal traffic; recall measures the proportion of actual attacks correctly detected; F1-score balances precision and recall into a single measure, particularly useful under class imbalance; Matthews Correlation Coefficient (MCC) provides a balanced measure of classification quality even when class sizes differ substantially; Cohen’s Kappa assesses agreement between predicted and actual classifications beyond chance; Area Under the ROC Curve (AUC) evaluates the model’s ability to discriminate between classes across all classification thresholds; false positive rate (FPR) quantifies normal traffic incorrectly flagged as attacks; false negative rate (FNR) quantifies attacks missed by the model; false discovery rate (FDR) measures the proportion of attack predictions that are incorrect; and Log Loss captures the confidence and calibration of probabilistic predictions.

Although the training partitions were balanced prior to model fitting, class distributions differed across the standalone datasets used for evaluation. Accordingly, accuracy is reported for completeness, but greater emphasis is placed on Matthews Correlation Coefficient (MCC)—supported by complementary metrics—as it provides a more reliable basis for comparing classification performance across varying dataset compositions.

Table 2, Table 3, Table 4, Table 5, Table 6 and Table 7 present the performance of all eleven algorithms across the datasets, where green values indicate the highest accuracy and red values indicate the lowest accuracy within each dataset condition.

4.3.1. Results Analysis for ECU-IoHT Dataset

Table 2 presents the results for the ECU-IoHT dataset, and the corresponding results are visualized in Figure 7. Ensemble methods achieved the strongest overall performance, with CatBoost recording the highest MCC (0.9282) and an accuracy of 96.62%, closely followed by XGBoost (MCC = 0.9268, 96.55% accuracy) and Gradient Boosting (MCC = 0.9258, 96.51% accuracy). Across the ensemble group, accuracy exceeded 95.8%, F1-scores were above 0.957, and AUC values surpassed 0.985, indicating strong classification reliability and effective class separation. KNN and SVM delivered moderate results, with accuracies of 95.60% and 93.56%, respectively. SVM showed a relatively balanced error distribution, producing 149 false positives and 150 false negatives, although its overall performance remained below that of the leading ensemble models. MLP achieved 89.23% accuracy but recorded a comparatively high false negative rate (0.2506), suggesting reduced sensitivity to attack instances and an increased likelihood of missed threats. Logistic Regression and Naive Bayes produced the weakest outcomes on this dataset, with accuracies of 76.28% and 76.92%, respectively. Both models also reported MCC values below 0.50 and false negative rates exceeding 45%, indicating limited effectiveness in capturing the complex and non-linear relationships present in the ECU-IoHT traffic data.

4.3.2. Results Analysis for WUSTL-EHMS Dataset

As shown in Table 3 and Figure 8, the performance pattern on the WUSTL-EHMS dataset differs markedly from that of ECU-IoHT. Here, linear and probabilistic models achieved the strongest results. Logistic Regression recorded the highest MCC (0.4126) with an accuracy of 87.47%, followed by SVM (MCC = 0.4022, 87.13% accuracy) and Naive Bayes (MCC = 0.3693, 85.75% accuracy). This reversal suggests that the WUSTL-EHMS traffic data contain relationships that are comparatively more linearly separable.

By contrast, the ensemble methods that performed strongly on ECU-IoHT showed clear deterioration. Random Forest, XGBoost, CatBoost, LightGBM, and Gradient Boosting all produced closely grouped accuracies between 82.63% and 83.46%. More importantly, each recorded false negative rates above 52%, indicating that more than half of the attack instances were not detected. MLP delivered the weakest overall result, achieving 81.56% accuracy and the highest false positive rate (0.1366). This combination suggests limited adaptability to the underlying structure of the dataset and reduced reliability in distinguishing normal traffic from threats.

The findings indicate that classifier effectiveness is strongly influenced by dataset characteristics. They also highlight the importance of augmentation strategies that can improve feature diversity and class representation, thereby reducing the performance gap between the two baseline datasets.

4.3.3. Results Analysis for Rule-Based Augmented Dataset

Table 4 indicates that the Rule-Based augmented dataset produced the strongest overall results among all evaluated configurations, as further illustrated in Figure 9. The highest MCC was achieved by LightGBM (0.9757) with an accompanying accuracy of 99.18%, while CatBoost (MCC = 0.9752, 99.16% accuracy) and Gradient Boosting (MCC = 0.9748, 99.15% accuracy) followed by a very narrow margin. The close clustering of these scores reflects a highly learnable feature space under the Rule-Based configuration. Performance across the broader ensemble group remained consistently strong. LightGBM, CatBoost, Gradient Boosting, XGBoost, and Random Forest all exceeded 99% accuracy, while false positive rates remained below 0.8% and false negative rates below 1%. Such low error levels indicate highly reliable threat-detection capability, which is particularly valuable in security-sensitive healthcare environments.

The benefits of this augmentation strategy were not limited to ensemble methods. MLP improved substantially relative to its baseline result, reaching 98.04% accuracy with an MCC of 0.9409. This suggests that the enriched feature representation also supports neural network learning by providing more informative input patterns. AdaBoost and SVM likewise maintained strong results, with accuracies of 98.65% and 97.86%, respectively. Although Logistic Regression and Naive Bayes remained the lowest-performing models within this dataset, their accuracies of 91.72% and 91.52% still represent marked improvements over their baseline outcomes. This indicates that the Rule-Based enhancement improved learning conditions, even for simpler model families.

Overall, the Rule-Based strategy provides the most effective learning environment across the evaluated classical machine learning models, combining expanded feature representation with consistently strong classification performance.

4.3.4. Results Analysis for CTGAN-Based Augmented Dataset

As shown in Table 5 and Figure 10, the CTGAN-augmented dataset supports strong performance across most classifiers, with the best results concentrated among the ensemble models. XGBoost records the highest MCC (0.9047) and an accuracy of 95.37%, while LightGBM and CatBoost follow closely with MCC values of 0.9043 and 0.9039, respectively. The narrow performance gap among these models suggests that CTGAN generates a stable feature distribution that is particularly suitable for boosting-based learners.

The broader ensemble group also performs consistently well, with all five leading ensemble methods exceeding 95% accuracy and producing AUC values above 0.985. This indicates that the synthetic data preserve useful class distinctions and support reliable separation between attack and normal traffic instances.

Among the non-ensemble models, MLP delivers the strongest result, achieving 94.65% accuracy with an MCC of 0.8898. Its false positive rate (0.0343) and false negative rate (0.0803) remain relatively balanced, indicating an effective trade-off between missed threats and false alarms. AdaBoost and SVM show more moderate performance at 92.92% and 92.75% accuracy, respectively, although AdaBoost records a higher false negative rate (0.1264), suggesting reduced sensitivity to some attack patterns.

Logistic Regression and Naive Bayes remain the weakest performers, with accuracies of 84.56% and 85.66%, respectively. Their false negative rates exceed 25%, indicating that simpler decision boundaries still struggle to capture the full structure of the CTGAN-generated data, despite clear improvement over the baseline dataset results.

4.3.5. Results Analysis for TVAE-Based Augmented Dataset

As reflected in Table 6 and Figure 11, the TVAE-augmented dataset delivers consistently strong results and remains one of the most effective synthetic data configurations evaluated in this study. The top-performing models were again LightGBM, XGBoost, and CatBoost, which achieved MCC values of 0.9005, 0.8987, and 0.8969, respectively, with corresponding accuracies between 96.80% and 96.92%. The minimal differences among these models indicate that TVAE provides a stable and informative feature space for gradient-boosting algorithms.

Beyond the leading trio, overall ensemble performance remained high, with all ensemble methods recording accuracies above 95.74% and AUC values exceeding 0.988. This level of consistency suggests that the generated samples preserve the important structural relationships required for dependable intrusion detection.

A notable outcome of this dataset is the performance of MLP, which reached 96.20% accuracy and an MCC of 0.8814. This was the strongest neural network result across all six dataset configurations, indicating that TVAE is particularly effective at generating feature patterns that support representation learning. Random Forest offered the best control of false alarms, achieving the lowest false discovery rate (FDR = 0.0122). Such behavior is valuable in healthcare security environments, where excessive alerts may disrupt operations or reduce trust in the detection system.

The remaining conventional models performed adequately but below the leading methods. SVM and KNN achieved accuracies of 93.59% and 93.97%, while Logistic Regression and Naive Bayes recorded 90.14% and 90.70%, respectively. Although lower than the best-performing models, these results still represent clear improvements.

4.3.6. Results Analysis for Gaussian Copula–Based Augmented Dataset

As shown in Table 7 and Figure 12, the Gaussian Copula–augmented dataset produced the weakest overall results among the augmented configurations. MCC values remained modest across models, while accuracies ranged from 75.98% to 85.73%. This comparatively lower performance is consistent with the highly imbalanced class distribution, where attack samples accounted for 89.3% of the dataset.

SVM achieved the strongest overall result, recording the highest MCC (0.4508) and an accuracy of 85.73%, closely followed by Logistic Regression (MCC = 0.4496, 85.15% accuracy). This suggests that simpler margin-based and linear decision models adapted more effectively to the statistical structure of the copula-generated data than more complex ensemble methods.

The ensemble models showed stable but limited performance, with accuracies clustered between 79.52% and 80.20%. Although precision remained above 90% across these methods, recall was comparatively weaker, indicating difficulty in capturing the full range of attack patterns under severe imbalance. KNN recorded the weakest result, with 75.98% accuracy and the highest false negative rate (23.86%), suggesting reduced compatibility with the feature relationships present in this dataset.

False positive rates were elevated across all models, ranging from 15.91% (CatBoost) to 31.02% (SVM). In addition, the Negative Predictive Value remained low for every classifier, ranging from 26.97% (KNN) to 39.86% (SVM). These patterns indicate that the poorer results likely stem from both class imbalance and the limited quality of the generated normal traffic samples. In practical terms, models frequently misclassified genuine normal traffic as attacks, reducing reliability despite acceptable precision.

While the Gaussian Copula preserved certain statistical dependencies, its generated data were less effective for intrusion detection than the other augmentation strategies evaluated.

4.4. Evaluation of Existing vs. Augmented Datasets

This section critically assesses the performance of machine learning algorithms on augmented datasets versus individual existing datasets, empirically demonstrating the validity of data augmentation in the performance of machine learning algorithms used in detecting intrusion in the IoMT. The comparison between baseline performance using the original ECU-IoHT and WUSTL-EHMS data with all four augmentation methods indicates the presence of notable performance improvement in various assessment criteria.

4.4.1. Algorithm-Specific Improvement Analysis

The empirical results reported in

Table 8. Performance comparison of existing and augmented dataset-trained models.

Algorithm	ECU-IoHT	WUSTL-EHMS	Rule-Based	CTGAN	TVAE	Gaussian Copula
Random Forest	0.9623	0.8336	0.991	0.9526	0.9667	0.7965
XGBoost	0.9655	0.8309	0.9914	0.9537	0.9685	0.8019
SVM	0.9356	0.8713	0.9786	0.9275	0.9359	0.8573
LightGBM	0.9647	0.8263	0.9918	0.9535	0.9692	0.7993
CatBoost	0.9662	0.8275	0.9916	0.9532	0.968	0.8013
KNN	0.956	0.8229	0.971	0.9238	0.9397	0.7598
MLP	0.8923	0.8156	0.9804	0.9465	0.962	0.8064
Logistic Regression	0.7628	0.8747	0.9172	0.8456	0.9014	0.8515
AdaBoost	0.958	0.8346	0.9865	0.9292	0.9574	0.7952
Gradient Boosting	0.9651	0.8287	0.9915	0.9517	0.9679	0.802
Naive Bayes	0.7692	0.8575	0.9152	0.8566	0.907	0.7907

Note: Green values indicate the highest accuracy and red values indicate the lowest accuracy within each dataset condition.

and visualized in Figure 13 show that performance significantly improved across all tested models on the use of these augmented datasets. The findings demonstrate an impressive success rate, where all algorithms improved in performance when augmented, supporting the adaptability of the techniques in improving intrusion detection in IoMT. These improvements range from 1.50% (KNN) to 15.44% (Logistic Regression), indicating that augmentation advantages cut across various complexities of algorithms and various learning paradigms.

Ensemble algorithms such as Random Forest, XGBoost, LightGBM, CatBoost, AdaBoost, and Gradient Boosting showed consistent and significant improvements of 2.54 to 2.87. These algorithms are already excellent at 95.8–96.62 levels, but after optimal augmentation, these were pushed to high levels of 99%+. The stability of the across-ensemble methods improvement shows that these algorithms do well in exploiting the improved feature representation and increased training instances offered by the augmentation methods. Remarkably, the most successful results of all ensemble techniques were attained in the case of Rule-Based enhancement, which indicates a high degree of collaboration between ensemble learning techniques and Rule-Based synthetic data generation.

Neural networks showed the best performance change by augmentation, with MLP showing a phenomenal 8.81% improvement in accuracy from 89.23% with baseline data to 98.04% with augmented data. This significant gain proves that neural networks are especially sensitive to the quality and quantity of training data; therefore, augmentation methods have a beneficial impact on training data quality and class balance. The MLP results suggest that the original datasets lacked adequate representation of complex attack patterns, which augmentation effectively helped to correct by increasing and diversifying the training samples.

The largest relative improvements were observed for Logistic Regression and Naive Bayes, with gains of 15.44% and 14.60%, respectively. These results suggest that augmentation is particularly beneficial for simpler traditional models, which are often more constrained by limited dataset size, class imbalance, and insufficient feature diversity. After augmentation, Logistic Regression improved from 76.28% to 91.72% in accuracy, while Naive Bayes increased from 76.92% to 91.52%, demonstrating that appropriately enriched datasets can substantially improve the competitiveness of lower-performing models in IoMT intrusion-detection tasks.

SVM also showed a notable improvement of 4.30%, indicating that margin-based classifiers benefit from the enhanced feature representation introduced by augmentation. Although KNN recorded the smallest gain (1.50%), its consistent improvement suggests that distance-based methods can also benefit from increased training samples and better class representation.

The pattern of improvements indicates that augmentation benefits model families differently. The largest relative gains were observed among traditional algorithms, suggesting that these models were more affected by the limitations of the original datasets. Neural network performance also improved meaningfully, reflecting sensitivity to training data quantity and diversity. While relative gains were smaller for ensemble methods, they continued to achieve the highest absolute performance levels across the evaluated augmented datasets.

The performance assessment suggests that data augmentation is an effective strategy for addressing key limitations of the original IoMT datasets. The improvements across all eleven evaluated models indicate that the baseline datasets may have been constrained by limited attack diversity, uneven class distributions, and restricted feature variability. Augmentation appears to alleviate these issues by expanding training samples, improving class representation, and increasing feature richness.

The consistent improvements observed across all evaluated algorithms and augmentation methods suggest that data augmentation can be an effective strategy for enhancing IoMT intrusion-detection performance. Although formal statistical significance testing was beyond the scope of this study, the magnitude and consistency of the observed gains indicate practical relevance, particularly for models such as Logistic Regression and Naive Bayes that performed comparatively weakly on the original datasets.

From a deployment perspective, the performance gains were achieved with acceptable additional data-processing overhead. Although the augmented datasets were larger than the original datasets, the resulting improvements in detection capability may justify the added computational cost in security-sensitive healthcare environments, where reliable threat detection is important for operational continuity and patient safety.

Overall, the results in Table 8 indicate that appropriately augmented datasets can outperform the original datasets across the evaluated model families. Performance gains ranging from 1.50% to 15.44% across all eleven tested algorithms provide empirical support for the use of augmentation as a practical tool for improving IoMT intrusion-detection systems.

4.4.2. Class Imbalance Impact

The analysis of class distribution across the original and augmented datasets indicates that imbalance was an important factor influencing model performance. The two baseline datasets exhibited markedly different attack-to-normal traffic ratios. The ECU-IoHT dataset contained 78.9% attack instances, providing strong representation of threat scenarios but comparatively fewer normal samples. By contrast, the WUSTL-EHMS dataset contained only 12.5% attack instances, indicating substantial under-representation of malicious traffic and a more challenging learning environment for attack detection.

The Rule-Based augmentation method preserved the original 78.9% attack ratio while expanding the feature space, thereby maintaining the baseline class structure. In contrast, the generative augmentation methods produced noticeably different class distributions, each with distinct implications for model generalization. These findings suggest that augmentation performance depends not only on the quantity of generated samples, but also on how effectively class proportions are represented within the resulting dataset.

The best-performing model accuracies for each algorithm under both the original and augmented datasets are summarized in

Table 9. Overall comparison of best-performing existing and augmented dataset-trained models per algorithm. The “Improvement” column represents the absolute percentage-point gain between the best original dataset accuracy and the best augmented dataset accuracy for each algorithm.

Algorithm	Original Best	Augmented Best	Improvement
Random Forest	0.9623	0.991	+2.87%
XGBoost	0.9655	0.9914	+2.59%
SVM	0.9356	0.9786	+4.30%
LightGBM	0.9647	0.9918	+2.71%
CatBoost	0.9662	0.9916	+2.54%
KNN	0.956	0.971	+1.50%
MLP	0.8923	0.9804	+8.81%
Logistic Regression	0.7628	0.9172	+15.44%
AdaBoost	0.958	0.9865	+2.85%
Gradient Boosting	0.9651	0.9915	+2.64%
Naive Bayes	0.7692	0.9152	+14.60%

Note: Green values indicate the highest accuracy and red values indicate the lowest accuracy within each dataset condition.

and visualized in Figure 14.

TVAE produced a class distribution relatively close to the original dataset, with an attack ratio of 77.9%, indicating only a modest shift in class composition while still expanding the available training data. The CTGAN method generated the most balanced distribution, with 58% attack samples, which likely contributed to stronger generalization across both attack and normal traffic patterns. In contrast, the Gaussian Copula method produced a highly skewed distribution with 89.3% attack instances. Although this increased exposure to malicious patterns, the limited representation of normal traffic was associated with weaker overall performance and reduced discrimination between legitimate and attack behavior.

4.5. Augmentation Techniques Comparative Analysis

As shown in

Table 10. Augmentation method performance summary.

Augmentation Method	Best MCC	Best F1-Score	Best Accuracy	Best Algorithm	Remarks
Rule-Based	0.9757	99.19%	99.18%	LightGBM	Optimal
TVAE-Based	0.9005	96.94%	96.92%	LightGBM	Strong
CTGAN-Based	0.9047	95.35%	95.37%	XGBoost	Competitive
Gaussian Copula–Based	0.4508	87.32%	85.73%	SVM	Limited

and Figure 15, the comparative evaluation demonstrates clear performance differences among the four augmentation techniques examined: Rule-Based, TVAE, CTGAN, and Gaussian Copula. Based on Matthews Correlation Coefficient (MCC), F1-score, classification accuracy, and error behavior collectively, the Rule-Based method delivered the strongest overall performance across the evaluated models. TVAE emerged as the strongest generative augmentation approach, while CTGAN also produced consistently competitive results. In contrast, the Gaussian Copula method recorded the weakest overall outcomes, with its effectiveness constrained by the highly imbalanced class distribution generated in the augmented dataset.

The Rule-Based technique produced the strongest overall results, with ensemble models exceeding 99% in both accuracy and F1-score while also recording the highest MCC (0.9757). It further maintained very low false positive rates (0.62–0.77%) and false negative rates (0.86–0.94%), indicating highly reliable intrusion-detection capability. These characteristics make it particularly suitable for security-sensitive healthcare environments, where dependable threat detection is essential.

Among the generative approaches, TVAE demonstrated the strongest overall practical performance, achieving the highest F1-score (96.94%) and accuracy (96.92%). CTGAN remained closely competitive, recording a marginally higher MCC (0.9047) and consistently robust classification results across models.

By contrast, the Gaussian Copula method generated a highly skewed class distribution with 89.3% attack samples. This was associated with elevated false positive rates (15.9–31.0%), weaker MCC values, and lower overall classification consistency. Although attack detection remained moderate, reduced representation of normal traffic limited the reliable discrimination of legitimate network behavior.

Overall, the findings indicate that augmentation effectiveness depends not only on dataset expansion, but also on how well the generated data preserve class balance, feature diversity, and realistic traffic relationships.

4.6. Summary of Results

The overall findings indicate that data augmentation substantially improves IoMT intrusion-detection performance across diverse machine learning algorithms. Performance gains were consistently reflected through stronger MCC, F1-score, and accuracy values when compared with the baseline datasets, confirming that enhanced data representation can meaningfully improve model learning behavior.

Across the evaluated methods, ensemble algorithms remained the most reliable performers, particularly when trained on augmented datasets with improved feature diversity and more balanced class structures. Traditional models such as Logistic Regression and Naive Bayes recorded the largest relative improvements, indicating that simpler classifiers benefit strongly when limitations of the original datasets are reduced. Neural network performance also improved, suggesting sensitivity to increased training diversity.

Among the augmentation strategies, methods that preserved both class balance and realistic feature relationships produced the strongest outcomes, whereas highly skewed synthetic distributions reduced generalization performance despite moderate attack-detection capability. These results highlight that augmentation quality is determined not only by dataset expansion, but also by the statistical realism of the generated samples.

The findings provide practical guidance for selecting augmentation strategies according to security requirements, computational constraints, and deployment priorities in IoMT environments. They also support the study objectives relating to dataset generation, performance validation, and the development of more effective cybersecurity strategies for future IoMT systems.

5. Conclusions

This study examined the use of data augmentation as a strategy for improving intrusion-detection performance in Internet of Medical Things (IoMT) environments, where cybersecurity research is frequently constrained by limited and insufficiently diverse datasets. Three objectives guided the work: generating enriched datasets that represent a broader range of cyber threats, evaluating their effect on machine learning performance, and determining which augmentation strategies are most suitable for IoMT threat-detection scenarios.

The findings indicate that the study objectives were successfully achieved. Across six dataset configurations and eleven evaluated algorithms, augmented datasets consistently outperformed the original baseline datasets in terms of MCC, F1-score, and classification accuracy. This demonstrates that improving data quality and representation can significantly enhance learning effectiveness in IoMT intrusion-detection systems.

A central contribution of the study is the observation that augmentation benefits model families differently. Ensemble methods remained the most reliable overall performers, while simpler models such as Logistic Regression and Naive Bayes recorded the largest relative gains. This suggests that augmentation can reduce the performance gap between conventional and more advanced classifiers, particularly in data-scarce environments. The comparative analysis further showed that augmentation effectiveness depends not only on increasing dataset size, but also on preserving class balance, feature diversity, and realistic traffic relationships. Methods that maintained these properties produced stronger and more stable results than techniques generating heavily skewed class distributions.

From a practical perspective, the findings provide useful guidance for selecting augmentation strategies according to security requirements, computational constraints, and deployment priorities in healthcare IoT systems. Data augmentation therefore represents a promising pathway for strengthening proactive cyber defense in increasingly connected medical infrastructures.

This study is not without limitations. The evaluation was restricted to traditional, ensemble, and shallow neural network models, while more advanced deep learning architectures, such as 1D-CNNs, LSTMs, and transformer-based models, were not included. In addition, only two source datasets were examined. Future work should investigate hybrid augmentation strategies, real-time adaptive augmentation pipelines, broader cross-dataset validation, and federated learning frameworks for privacy-preserving threat intelligence sharing across healthcare institutions.

6. Recommendations and Future Work

Healthcare technology teams may consider integrating the Rule-Based augmentation technique into intrusion-detection frameworks that leverage high-performing ensemble models such as LightGBM. This approach appears particularly suitable for security-sensitive medical device networks where reliable threat detection is essential. Development teams could also implement automated data augmentation pipelines capable of refreshing training datasets as new IoMT threat patterns emerge. Modular augmentation libraries would further support deployment by enabling augmentation components to be incorporated into existing security infrastructures with minimal disruption. In this context, TVAE-based approaches offer a practical balance between predictive performance and computational efficiency, making them attractive for resource-constrained environments.

Future research should examine hybrid augmentation systems that combine the feature diversity advantages of Rule-Based methods with the generalization capabilities of generative models. Federated learning frameworks built on augmented datasets also warrant investigation, as they could enable threat intelligence sharing across healthcare institutions while preserving patient privacy. Additional studies should compare the augmentation techniques proposed in this work against modern deep learning baselines, including convolutional, recurrent, and transformer-based architectures, to further assess the robustness and transferability of the findings. Research into real-time adaptive augmentation mechanisms that respond dynamically to evolving IoMT attack vectors could also strengthen proactive cybersecurity defenses.