Neuro-Fuzzy Approach for Detecting DDoS Attacks in IoT Environments Applied to Biosignal Monitoring

Abstract

Distributed denial-of-service (DDoS) attacks pose a critical threat to the availability of the Internet of Medical Things (IoMT). This paper proposes an intrusion detection system (IDS) based on a hybrid neuro-fuzzy-inspired approach to identify DDoS attacks in IoMT environments. The architecture combines an ensemble of decision trees, a sigmoidal smoothing mechanism, and a multilayer neural meta-classifier, enabling the modeling of nonlinear relationships between legitimate and malicious traffic without requiring explicit fuzzy rules or a formal fuzzy inference mechanism. The evaluation was conducted using the public DoS/DDoS-MQTT-IoT dataset, which was extended by incorporating legitimate traffic generated by electrocardiography (ECG) monitoring devices to approximate real operational IoMT conditions. The model was validated using stratified cross-validation and bootstrap procedures. In the extended IoMT scenario including ECG traffic, the proposed approach achieved an area under the ROC curve (AUC) of 0.904 and an F1 score of 0.823. Finally, the IDS was integrated into an intrusion detection and prevention system (IDPS) capable of detecting anomalous traffic patterns within three seconds and automatically blocking malicious IP addresses after repeated detections.

1. Introduction

Since the early development of digital information systems, the theft of confidential data [1] and the deliberate disruption of critical services through network resource congestion [2,3] remain a significant threat to information systems. These actions generate significant economic losses and compromise the reliability and operational continuity of systems within organizations. In this context, cybersecurity has become essential, especially in the increasing adoption of distributed and interconnected architectures.

Additionally, with the expansion of the Internet of Things (IoT), integrating numerous devices with limited security capabilities increases the number of vulnerable points and, consequently, the risk and potential scale of cyberattacks increase [4,5,6]. This scenario is particularly relevant in the healthcare sector, where digitization and connectivity have established the IoMT [7,8,9], generally structured in four layers: perception, gateway, cloud, and application [10]. Since healthcare services depends on communication between these layers, weaknesses in any of them can spread and affect the security and continuity of care. Therefore, each layer has specific vulnerabilities.

The perception layer is susceptible to sniffing attacks, based on passive capture of network traffic, and radio frequency interference [11,12]. The gateway layer, which acts as a bridge between devices and the network, faces threats such as ARP spoofing, an attack that exploits the Address Resolution Protocol (ARP), Domain Name System (DNS) poisoning, and denial-of-service (DoS) and DDoS attacks [13,14].

The cloud layer, responsible for storing and processing data, is exposed to privacy violations and malware [15], and DoS/DDoS attacks [3,13,16]. The application layer, where users interact with the system through clinical applications, APIs, and lightweight messaging protocols such as MQTT (message queue telemetry transport), CoAP (constrained application protocol), and HTTP (hypertext transfer protocol), is vulnerable to exploits of these protocols [17,18] and to DoS/DDoS attacks [15,19].

According to existing studies, DoS/DDoS attacks target different layers of the IoMT architecture, adopting volumetric traffic injection methods, such as classic Flooding, as well as Low-rate attacks [20,21]. In response to the diversity and complexity of these attack vectors, various solutions based on machine learning [22,23], deep learning [24], ensemble artificial intelligence models [25], and blockchain technologies [26] have been proposed, aimed at the early detection of malicious traffic and the protection of medical data.

Within the deep learning-based approaches, several studies have explored modern intrusion detection architectures such as Long Short-Term Memory (LSTM) recurrent neural networks, convolutional neural networks (CNNs), and hybrid models capable of capturing complex temporal and spatial patterns of network traffic [14,24]. These architectures have demonstrated high performance in identifying attacks in IoT environments. However, different studies indicate that even optimized or lightweight variants of these models can present difficulties for deployment in IoMT infrastructures due to their consumption of computational resources, memory requirements, and inference latencies—critical factors in connected medical devices and real-time monitoring platforms [27].

In Ecuador, studies on security in IoT and IoMT environments have mainly focused on analyzing vulnerabilities and risks of cyberattacks. These studies identify that insecure configurations and connected medical devices can be exploited to cause service interruptions and DDoS attacks [28,29]. However, the proposed solutions are often limited to preventive diagnostics, lacking real-time detection or active mitigation mechanisms.

In the province of Santa Elena, research has been conducted on detecting intrusions into critical infrastructure [30] and identifying DDoS attacks on networks using machine learning techniques [31]. However, a significant gap remains: this work does not address specific IoMT architectures or security in critical layers such as gateways or lightweight messaging protocols.

To overcome these limitations, this work adopts a neuro-fuzzy approach based on a hybrid assembly. This approach integrates a set of decision trees with sigmoid smoothing and a multilayer neural metaclassifier (MLP), resulting in a structure inspired by neuro-fuzzy systems, but without explicit rules or a formal fuzzy inference mechanism. The model captures uncertainty in IoMT traffic through smooth, adaptive transitions based on sigmoid functions, which resemble membership functions, eliminating the need to define manual heuristic rules.

This research is being conducted within the framework of the multidisciplinary project “Research on IoT applications in the acquisition of bioelectrical signals” (CUP: 91870000.0000.389571), led by the Technology, Science, and Education (TECED) group at the Santa Elena Peninsula State University (UPSE). Given that the project envisages an IoMT environment for monitoring vital signs using IoT devices and transmitting biomedical data via the MQTT protocol [7,32], this study focuses on evaluating the performance of an intrusion prevention system aimed at mitigating DDoS attacks in this environment. To address the identified limitations in real-time IoMT protection, this article presents three main contributions.

(i)

Development of a hybrid neuro-fuzzy detection model. A lightweight architecture is proposed that combines an ensemble of decision trees with a sigmoidal smoothing mechanism and a multilayer perceptron (MLP) meta-classifier. This structure enables the modeling of nonlinear relationships between legitimate and malicious MQTT traffic without requiring explicit fuzzy rules.

(ii)

Experimental validation using an IoMT traffic dataset. The proposed model was evaluated using the DoS/DDoS-MQTT-IoT dataset extended with legitimate electrocardiogram (ECG) traffic, applying stratified cross-validation and bootstrap confidence intervals to assess classification performance.

(iii)

Implementation of a practical intrusion detection and prevention workflow. The proposed approach was integrated into a real-time monitoring environment where detection events trigger network-level mitigation rules, demonstrating the feasibility of automated response mechanisms in MQTT-based IoMT infrastructures.

The remainder of this article is organized as follows. Section 2 describes the materials and methods used for system implementation and model training. Section 3 presents the experimental results and performance evaluation. Section 4 discusses the implications of the findings. Finally, Section 5 summarizes the main conclusions of the study.

2. Materials and Methods

This study proposes a hybrid neuro-fuzzy-inspired system for detecting distributed denial-of-service (DDoS) attacks in IoMT environments using the MQTT protocol for data transmission. The experimental methodology was structured in several stages. Initially, the IoMT infrastructure under study was characterized, and the critical area to be protected was identified, along with the types of attacks considered in the analysis. Based on this definition, the dataset was constructed, and preprocessing and normalization processes were applied. Subsequently, flow-level feature engineering and training of the proposed model were carried out. Finally, statistical validation and experimental comparison of the results were performed, and the model was implemented in an IDPS.

2.1. Characterization of the IoMT Infrastructure Under Study

The infrastructure integrates devices for capturing heart rate, oxygen saturation (SpO₂), body temperature, and ECG monitoring signals (developed at UPSE, Santa Elena, Ecuador). These devices periodically transmit data to a centralized MQTT broker implemented with Eclipse Mosquitto (version 2.0.22). Communication between devices, backend services, and user interfaces is handled via MQTT, HTTPS, and WebSocket, enabling interoperability and real-time access. Processing and storage are performed on a virtual private server (VPS) with 16 GB of RAM and 400 GB of storage, running on a Linux operating system and a Docker container-based architecture. Structured and unstructured data persistence is managed using MariaDB (version 11.8.6) and MongoDB (version 7.0.28), respectively.

2.2. Identification of the Area to Be Protected and the Type of Attacks to Be Analyzed

The proposed system aims to protect the availability of the MQTT service against DDoS attacks. The communication channel to the centralized broker was identified as a critical area, since its saturation would compromise the transmission of real-time biosignals. Two types of attacks were considered: flooding_basic (high sending rate) and flooding_delayed (flooding with low temporal intensity), according to the DoS/DDoS-MQTT-IoT dataset nomenclature. Normal and attack scenarios were selected to construct a representative dataset.

2.3. Building the Dataset

The experimental analysis used PCAP network captures from the dataset. The files were processed using Tshark (Wireshark version 4.6.4), allowing the systematic extraction of fields belonging to the IP, TCP, and MQTT layers. The extracted records included IP addresses, TCP ports, TCP flags, window size, RTT, frame length, MQTT message type, and QoS level. Subsequently, the data were transformed into CSV format to facilitate structured processing and ensure record integrity.

To approximate the experimental environment to real-world IoMT operating conditions, the dataset was extended by incorporating legitimate traffic generated by an ECG device deployed in the infrastructure described in Section 2.1. The captures were obtained in PCAP format and processed using the same feature extraction flow applied to the public dataset. Based on this procedure, two experimental configurations were defined:

(i)

Baseline scenario: composed exclusively of the public DoS/DDoS-MQTT-IoT dataset, used as a reference for comparison with the literature.

(ii)

Extended scenario: comprising the integration of the public dataset with real traffic generated by the ECG device, introducing characteristic patterns of biomedical telemetry such as periodic transmissions and low temporal variability.

This extension allowed for the evaluation of the model’s behavior under both controlled experimental conditions and scenarios closer to the actual operation of IoMT systems.To empirically verify the differences between the flooding_basic and flooding_delayed scenarios defined in the DoS/DDoS-MQTT-IoT dataset, a comparative statistical analysis was performed on temporal and volumetric characteristics derived at the flow level. The non-parametric Mann–Whitney U test was applied to evaluate significant differences in the variables inter-arrival time (IAT), packet rate, and byte rate, considering a significance level of α = 0.05. This test was selected due to the absence of normality assumptions in the network traffic distributions.

2.4. Data Preprocessing and Normalization

The preprocessing consisted of a structured cleaning of the traffic corresponding to the normal, flooding_basic, and flooding_delayed scenarios. Only incomplete records in critical fields source IP address, destination IP address, and frame size (frame.len) were removed, as these were essential for constructing flows and calculating time and volume metrics.

Packets lacking MQTT layer information were not discarded; instead, default values were assigned to preserve the consistency of the dataset and avoid bias in the modeling of the flooding_basic and flooding_delayed scenarios. TCP flags were converted from hexadecimal to decimal format, and all relevant variables were transformed to controlled type casting, replacing missing values when necessary. Finally, the continuous variables were normalized using Min–Max scaling [33], according to Equation (1).

$$x^{\prime }={\displaystyle \frac{x-x_{min}}{x_{max}-x_{min}}}$$

(1)

The parameters $x_{min}$ and $x_{max}$ were estimated exclusively on the training set and reused during the inference phase to avoid information leakage.

2.5. Flow-Level Feature Engineering

On the previously cleaned records, a feature engineering phase focused on flow-level analysis was performed. First, the data was chronologically ordered, and a unique TCP flow identifier was constructed by combining source and destination IP addresses and ports. From this structure, the IAT was calculated as the difference between consecutive timestamps within the same flow, according to Equation (2).

$${IAT}_i=t_i-t_{i-1}$$

(2)

Additionally, binary variables derived from TCP flags were incorporated, including indicators for the SYN, FIN, and RST flags, as well as a variable indicating the presence of the MQTT protocol. To capture traffic dynamics, a time aggregation scheme was implemented in discrete one-second windows. In each window and for each identified flow, the packet rate was calculated as the total number of observed packets, and the byte rate as the sum of the packet sizes transmitted during that interval, according to Equation (3).

$$ByteRate=\sum _{k=1}^{n}le{n}_k$$

(3)

Finally, the missing values generated during the aggregation process were replaced with zero to ensure the structural consistency of the dataset. To structure the dataset for supervised training, the previously identified scenarios were encoded with numerical labels, assigning the value 0 to normal traffic and 1 to attack scenarios. Subsequently, a stratified sampling process was performed by class, limiting the maximum number of records per category to 300,000 samples, in order to reduce potential imbalances and control the dimensionality of the training set.

2.6. Training of the Proposed Hybrid

The proposed detection model was designed as a two-tiered hybrid architecture combining fuzzy-inspired principles, tree-based learning, and deep neural optimization. The main motivation behind this integration is to overcome the structural limitations of classic Sugeno-type ANFIS systems, whose complexity grows exponentially with the number of rules and membership functions when working with multiple continuous variables. In highly variable MQTT traffic scenarios, this growth proves difficult to scale [34,35]. The detailed architecture of the proposed model, which integrates the fuzzy tree ensemble with the neural meta-classifier, is presented in Figure 1.

Figure 1. Architecture of the proposed hybrid. The processing flow (indicated by arrows) transitions from the Fuzzy Decision Ensemble (orange blocks) to a Feature Vector of latent probabilities (green block). This vector is subsequently processed by the MLP Meta-Classifier (blue blocks) to produce the final Binary Prediction (red block) based on the Youden Index $\left(\tau \right)$.

As opposed to approaches based on explicit rules or formal fuzzy inference systems, the proposed model automatically learns feature space partitions from the data, maintaining structural interpretability and statistical generalizability [36]. The model was trained using four descriptors derived from flow-level analysis: IAT, packet rate, byte rate, and frame length. These variables were selected because they are available early at the network and transport layers, allowing for low-latency extraction without relying on deep processing at the application layer. Consequently, the input vector has a dimensionality of d = 4.

Let the training set be (4):

$$D={\left\{\right(x_i,y_i\left)\right\}}_{i=1}^N, {x_i\in \mathbb{R}}^d,y_i\in \{0,1\}$$

(4)

where $x_i$ represents the feature vector of the MQTT flow and $y_i$ indicates legitimate traffic defined as 0 or attack as 1.

The proposed approach does not implement a formal fuzzy inference engine (e.g., rule-based reasoning or explicit membership functions). Instead, it models uncertainty using continuous sigmoid transformations, resulting in smooth, fuzzy-like behavior [37].

2.6.1. Ensemble of Trees with Implicit Fuzzy-like Behavior Based on Sigmoid Smoothing

At the first level, a set of M decision trees is trained using bootstrap sampling and random selection of feature subsets, which introduces structural diversity and reduces model variance. The bootstrap sampling was performed with replacement and with a size equal to the original training set, ensuring that each tree was trained on a distinct sample of the data space. In each tree, three of the four available features were randomly selected, without replacement, for training. This mechanism increases ensemble diversity and avoids systematic dependence on a single descriptor in generating decision rules.

In a classical tree, each internal node divides the space according to a deterministic rule (5):

$$x_j\le \theta \mathrm{o}\mathrm{r} x_j>\theta$$

(5)

However, this mechanism produces abrupt boundaries that do not adequately model gradual transitions between normal and malicious traffic. To resolve this limitation, the binary decision is replaced by a sigmoidal membership function (6):

$$\mu (x_j,\theta )={\displaystyle \frac{1}{1+e^{-k(x_j-\theta )}}}$$

(6)

To determine a suitable value for the sigmoidal smoothing parameter k, a sensitivity analysis was performed evaluating the ensemble k ∈ {10, 20, 40, 60}. Each configuration was trained and validated under the same experimental scheme described in Section 2.7, using 5-partition stratified cross-validation and threshold-independent optimization using the Youden index at each fold. The value adopted for the final experiments was the one that showed the greatest stability and balance between performance metrics across the partitions.

Additionally, a sensitivity analysis was performed to evaluate the influence of the number of trees in the ensemble. Four configurations of the ensemble size (M ∈ {10, 20, 30, 40}) were analyzed using three-partition stratified cross-validation under the same training conditions. Model performance was evaluated using the AUC. In order to determine whether the observed differences between configurations were statistically significant, the non-parametric Kruskal–Wallis test was applied to the AUC values obtained in each partition, since this test does not assume normality in the distribution of the performance metrics.

To determine the appropriate depth of the decision trees used as base classifiers, a sensitivity analysis of the max_depth hyperparameter was performed. Multiple configurations within the range d ∈ {4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 30, 40} were evaluated. For each configuration, the model was trained using a partitioning scheme of 70% for training and 30% for testing, keeping the other tree hyperparameters constant. Performance was evaluated using the AUC.

The final depth was selected using the 1% rule, which consists of choosing the least complex configuration whose performance falls within 1% of the maximum AUC obtained. This criterion reduces model complexity by avoiding unnecessary increases in tree depth. This modification transforms each node into a probabilistic interpolation operator. If $P_R$ and $P_L$ are the estimated probabilities at the left and right child nodes, respectively, the smoothed probability is defined as (7):

$$P_m\left(y= 1∣\mathrm{x}\right)=\mu P_R+(1-\mu )P_L$$

(7)

The probabilities $P_R y P_L$ correspond to the empirical proportion of samples belonging to the positive class in each child node. In this way, each tree generates a smooth probabilistic output $P_m$ ($y$ = 1|x), avoiding abrupt discontinuities and allowing for the modeling of gradual transitions between legitimate and malicious traffic.

The ensemble produces the output vector (8):

$$z\left(x\right)= {\left[P_1\right(x),P_2(x), \dots ,P_M(x) ]}^Tϵ{\mathbb{R}}^M$$

(8)

This vector constitutes a high-level representation of the traffic pattern, where each component captures a distinct structural perspective of the decision space. Conceptually, each tree can be interpreted as a set of fuzzy-like decision patterns of the type: “IF conditions on features THEN attack probability.” However, these rules are not defined manually but are automatically induced from the data. All stochastic processes involved in bootstrap sampling, feature subset selection, neural network initialization, and data partitioning were controlled by fixing the random seed at 42, ensuring complete experimental reproducibility.

2.6.2. Neural Meta-Classifier

The vector $z$ $ϵ{\mathbb{R}}^M$ generated by the tree ensemble is used as input to a multilayer neural network (MLP) composed of two hidden layers of 32 and 16 neurons, respectively. Since the ensemble is composed of M = 30 trees, the meta-classifier’s input vector has dimensionality M = 30.

The output of the first hidden layer is defined as (9):

$$h^{\left(1\right)}=\sigma (W^{\left(1\right)}z+b^{\left(1\right)})$$

(9)

and the second layer:

$$h^{\left(2\right)}=\sigma (W^{\left(2\right)}{h}^{\left(1\right)}+b^{\left(2\right)}),$$

(10)

where σ(⋅) corresponds to the ReLU activation function.

The estimated attack probability is obtained through sigmoidal activation in the output layer (11):

$$\widehat{y}={\sigma }_o(W^{\left(3\right)}{h}^{\left(2\right)}+b^{\left(3\right)}),$$

(11)

where σ_o (⋅) represents the logistic function.

This meta-classifier acts as an adaptive aggregation mechanism, learning nonlinear combinations of the outputs generated by the base trees. Training was performed using the Adam optimizer, with a maximum of 300 iterations and a fixed random seed of 42 to ensure experimental reproducibility.

2.6.3. Decision Rule

The final binary classification is determined by a threshold $\tau$:

$$\mathrm{ŷ}class= \left\{\begin{array}{c}1, if \mathrm{ŷ} \ge \tau \\ 0, otherwise. \end{array}\right.$$

(12)

The optimal value of τ is selected by maximizing the Youden statistic on the ROC curve, ensuring a balance between sensitivity and specificity.

2.7. Experimental Comparison and Statistical Validation

All models were trained and tested under equivalent experimental conditions, using the same set of input features and a 70% training 30% testing partitioning scheme, with class stratification to preserve the proportion of normal to malicious traffic. The decision threshold was optimized in each case using the Youden index, ensuring a consistent comparison in terms of sensitivity and specificity.

2.7.1. Configuration of Comparative Models

To establish a solid comparative reference, two classifiers widely reported in the intrusion detection literature were implemented. The multilayer neural network (MLP) was configured with two hidden layers of 32 and 16 neurons, respectively, using the hyperbolic tangent activation function (tanh) and optimization via the Adam algorithm. The activation of each neuron in the hidden layer is defined as (13):

$$h_j=\tanh \left({\sum }_{i=1}^n{w}_{ij}{x}_i+b_j\right),$$

(13)

where $w_{ij}$ represents the synaptic weights, $b_j$ the bias term, and $x_i$ the model inputs. A maximum of 600 training iterations was established, and L2 regularization with a parameter α = 10⁻⁴ was incorporated to mitigate overfitting.

The Random Forest (RF) model was implemented with 200 decision trees, allowing full growth (max_depth = None), a minimum of one sample per leaf, and full processing parallelization (n_jobs = −1) to optimize computational efficiency. In both cases, the input characteristics and data partitioning scheme were kept constant, ensuring methodological consistency in the comparison.

2.7.2. Statistical Validation Procedure

To evaluate the stability and robustness of the models’ performance, two complementary statistical validation procedures were applied.

First, 5-fold stratified cross-validation was used, ensuring that each subset preserved the original proportion of normal to malicious traffic. In each partition, the model was completely retrained from scratch using only the data from the corresponding training subset. The decision threshold was also independently optimized in each fold using the Youden index calculated from the ROC curve of the validation subset [38]. Performance metrics were calculated for each model in each partition, and the mean, standard deviation, and 95% confidence intervals, estimated using percentiles, were reported.

Second, a bootstrap resampling procedure was performed on the final test set, using 1000 iterations with replacement. This procedure allowed for the estimation of 95% confidence intervals for the AUC and F1-score, quantifying the variability of performance under different simulated subsets of the test set. Both procedures were applied consistently to all evaluated models, ensuring uniformity in the experimental protocol and statistical comparability between approaches.

To analyze the detector’s robustness against different attack configurations, a scenario-by-scenario evaluation was performed on the test set corresponding to the hold-out scheme (70% training 30% test).

The trained binary model was evaluated without further retraining, maintaining the optimal threshold previously estimated using the Youden index. Independent metrics were generated for the subsets: (i) Normal vs. flooding_basic and (ii) Normal vs. flooding_delayed, filtering only the corresponding samples within the test set.

2.8. Implementation of the Model in an IDPS

The proposed hybrid model was integrated into an IDPS designed to operate in real-time on traffic directed to the MQTT broker. The system continuously monitors the incoming packet flow and extracts, for each analysis time window, a reduced set of network metrics previously used during the model training phase.

In each time interval, four flow-level descriptors are calculated: IAT, packet rate, byte rate, and average frame length. These variables are then normalized using the same Min-Max scaling scheme estimated during model training, ensuring consistency between the training and inference phases.

Once normalized, the features are evaluated by the hybrid deployed in production. The system generates a real-time probabilistic attack score from the structural aggregation of the outputs of the sigmoidal smoothing tree ensemble and their subsequent combination using the multilayer neural meta-classifier. Unlike traditional detection schemes based on instantaneous decisions, the activation of countermeasures does not depend on a single, isolated inference. To reduce false positives and avoid premature blocking, the system employs a cumulative detection mechanism based on consecutive time windows. In this scheme, each time the attack probability generated by the model exceeds the optimal decision threshold τ, previously estimated using the Youden index, a counter associated with the source IP address is incremented.

Traffic processing is performed in discrete one-second windows. During each window, flow metrics are calculated and the model’s inference is executed. If the attack score exceeds the decision threshold, the counter of consecutive detections is incremented; otherwise, the counter is progressively decremented, allowing for the absorption of temporary fluctuations in legitimate traffic without triggering unnecessary mitigation mechanisms.

When the number of consecutive detections reaches the configured value (ATTACK_REPEAT_LIMIT), the system automatically executes network-level mitigation actions. These actions consist of dynamically inserting filtering rules into iptables, blocking incoming and forwarded traffic associated with the IP address identified as the attacker. Additionally, active connections linked to that address are terminated using conntrack, enabling the immediate termination of established sessions and the containment of the malicious flow before it significantly impacts the availability of the MQTT broker (Figure 2).

Figure 2. System architecture integrating the IDPS. The arrows represent the direction of data flow and communication between system components. IoT devices transmit data through the network layer to the proposed IDPS, which processes the traffic and forwards it to the MQTT broker. The broker then distributes the data to the application layer components.

Furthermore, the system incorporates a real-time monitoring module that allows visualization of traffic status, inference scores generated by the model, and the mitigation actions applied. This functionality facilitates operational inspection of system behavior and allows verification of the entire process of detection and response to security events.

The operational parameters used during the deployment and experimental validation phase in the VPS environment are presented in Table 1.

Table 1. Operating parameters of the real-time detection and mitigation system.

Category	Parameter	Value
Model	Number of trees (M)	30
Model	max_depth	10
Model	min_samples_leaf	10
Model	Sigmoid sharpness (k)	40
Model	MLP architecture	30 → 32 → 16 → 1
Model	MLP activation	ReLU
Model	Decision threshold (τ)	Optimized (Youden index)
Operation	ATTACK_REPEAT_LIMIT	10
Operation	Time window	1 s
Operation	Monitored port	1883 (MQTT)
Mitigation	iptables rule	INPUT + FORWARD (DROP)
Mitigation	Connection removal	conntrack-D
Environment	System	Linux VPS

3. Results

3.1. Statistical Validation of the Dataset

The results of the statistical analysis confirmed significant differences between the flooding_basic and flooding_delayed scenarios. The values obtained are presented in Table 2. The IAT variable showed a mean of 33.73 in the flooding_basic scenario and 63.45 in flooding_delayed, demonstrating considerably longer time intervals in the low-rate attacks. The Mann–Whitney U test indicated highly significant differences (p < 0.001).

Table 2. Statistical comparison between flooding_basic and flooding_delayed scenarios.

Feature	Mean Flooding_Basic	Mean Flooding_Delayed	p-Value
IAT	33.73	63.45	<0.001
pkt_rate	5.68	5.78	<0.001
bytes_rate	399.97	383.47	<0.001

Similarly, the packet rate and byte rate showed statistically significant differences between scenarios (p < 0.001), confirming that both types of attack exhibit structurally distinct temporal and volumetric patterns. These results validate the integrity of the dataset labeling and support the existence of differentiated behaviors between volumetric attacks and low-intensity temporal attacks.

3.2. Model Evaluation Using the Public Dataset

3.2.1. Scenarios with Observable Metrics in Production

Table 3 presents the overall performance metrics of the proposed hybrid model under the hold-out scheme (70% training/30% testing), employing decision threshold optimization using the Youden index. The model achieved an accuracy of 0.802, a precision of 0.879, and a recall (sensitivity) of 0.815, demonstrating adequate ability to identify malicious traffic while maintaining a controlled false alarm rate. The F1 score of 0.846 confirms a consistent balance between accuracy and detection capability, a critical aspect in IoMT environments where both false positives and false negatives can affect service availability.

Table 3. Performance of the proposed hybrid.

Metric	Value
Accuracy	0.802
Precision	0.879
Recall/TPR	0.815
F1-score	0.846
AUC	0.876

Furthermore, the AUC = 0.876 indicates a robust ability to discriminate between legitimate and attack traffic. This value, close to 0.88, confirms that the model maintains robust separability between classes even under operational variability. The optimal decision threshold estimated using the Youden index was τ = 0.652, guaranteeing a balance between sensitivity and specificity in the final classification.

The model’s discriminatory capacity is analyzed using the ROC curve, which is shown in Figure 3. The confusion matrix presented in Figure 4 allows for the analysis of the classifier’s behavior in terms of Type I errors (false positives) and Type II errors (false negatives). The results show balanced discrimination between classes, with a reduced proportion of false positives, an aspect that is especially relevant in clinical IoMT environments, where the improper blocking of legitimate traffic could affect service continuity.

Figure 3. ROC curve of the proposed hybrid neuro-fuzzy-inspired model. The dashed line represents the performance of a random classifier (AUC = 0.5), used as a reference for comparison, while the proposed model with the dataset achieves an AUC of 0.876.

Figure 4. Confusion matrix of the proposed hybrid neuro-fuzzy-inspired model.

To complement the analysis under different threshold levels, Figure 5 presents the model’s Precision-Recall curve. It shows that the model maintains high levels of accuracy across a wide sensitivity range, indicating stable detection even when prioritizing false negative reduction.

Figure 5. Precision-Recall curve of the proposed hybrid neuro-fuzzy-inspired model.

As recall approaches values close to 1.0, accuracy gradually decreases, reflecting the expected behavior when prioritizing maximum attack detection. This pattern confirms the model’s stability and its ability to maintain a suitable balance between effective detection and false alarm control in IoMT environments with time variability.

3.2.2. Stratified (5-Fold) Cross-Validation

To evaluate the stability and robustness of the models considered, 5-fold stratified cross-validation was applied, completely retraining each architecture in each partition and independently optimizing the decision threshold using the Youden index. The comparative results are presented in Table 4.

Table 4. Comparison under stratified cross-validation (5-fold).

Model	AUC (Mean ± Std)	F1-Score (Mean ± Std)
Hybrid Neuro-Fuzzy-Inspired	0.878 ± 0.001	0.842 ± 0.006
MLP	0.844 ± 0.001	0.799 ± 0.002
Random Forest	0.876 ± 0.001	0.839 ± 0.008

The hybrid neuro-fuzzy-inspired model achieved an average AUC of 0.878 and an average F1 score of 0.842, showing reduced dispersion between partitions. Although the Random Forest model obtained a similar average AUC (0.876 compared to 0.878), the hybrid model exhibiteda slightly higher F1 score and lower relative variability in this metric, suggesting more consistent behavior in terms of the balance between accuracy and sensitivity. The MLP model showed the lowest performance in both metrics, demonstrating that integrating the ensemble with sigmoidal smoothing and neural meta-classification contributes to improving generalizability under data variability.

3.2.3. Bootstrap Validation

To quantify the variability in performance under different simulated subsets of the test set, a bootstrap procedure with 1000 iterations with replacement was applied to the hold-out set (30%). AUC and F1-score were calculated at each iteration, and 95% confidence intervals were estimated using percentiles (2.5–97.5).

As shown in Table 5, the hybrid model exhibited narrow ranges in both AUC and F1-score, demonstrating low dispersion and statistical stability under variations in the test set. The Random Forest model achieved the highest absolute AUC, confirming its high discriminatory capacity in terms of class ranking. However, its F1-score was lower than that of the hybrid model, indicating that, although the RF model optimizes overall separation (AUC), the neuro-fuzzy-inspired approach maintains a better operational balance between accuracy and sensitivity in the final binary classification.

Table 5. Bootstrap confidence intervals (95%).

Model	AUC (95% CI)	F1-Score (95% CI)
Hybrid Neuro-Fuzzy-Inspired	[0.8773–0.8800]	[0.8458–0.8484]
MLP	[0.8395–0.8423]	[0.7921–0.7949]
Random Forest	[0.8890–0.8913]	[0.7978–0.8008]

3.3. Evaluation in an Extended IoMT Scenario (Dataset + ECG Traffic)

Once the captured traffic from real ECG monitoring devices was incorporated, the performance of the proposed hybrid model was evaluated. Table 6 presents the overall metrics obtained under a hold-out scheme (70% training/30% testing), using decision threshold optimization with the Youden index.

Table 6. Performance of the proposed hybrid neuro-fuzzy-inspired model.

Metric	Value
Accuracy	0.840
Precision	0.903
Recall/TPR	0.765
F1-score	0.828
AUC	0.909

The model achieved an accuracy of 0.840, precision of 0.903, and recall of 0.765, demonstrating an adequate ability to identify malicious traffic while maintaining a controlled false alarm rate. The F1 score of 0.828 reflects a good balance between accuracy and detection capability, a critical aspect in IoMT environments, where both false positives and false negatives can affect the availability and reliability of medical monitoring systems.

The model achieved an AUC of 0.909, demonstrating an adequate ability to discriminate between legitimate and attack traffic. The optimal decision threshold, estimated using the Youden index, was τ = 0.509, providing an adequate balance between sensitivity and specificity in the final classification.

3.3.1. Hold-Out Assessment in Extended Scenario

The model’s behavior in the extended scenario is analyzed using the ROC curves, confusion matrix, and Precision-Recall presented in Figure 6a–c, showing behavior consistent with the results obtained in the base scenario.

Figure 6. Performance evaluation of the proposed hybrid neuro-fuzzy-inspired model. (a) Receiver Operating Characteristic (ROC) curve showing the discrimination capability between normal and attack traffic; the dashed line represents the performance of a random classifier (AUC = 0.5), used as a reference for comparison, while the proposed model achieves an AUC of 0.909; (b) confusion matrix summarizing the classification results in terms of true positives, true negatives, false positives, and false negatives; (c) Precision–Recall curve illustrating the trade-off between precision and recall in attack detection.

3.3.2. Cross-Validation in Extended Scenario

To evaluate the stability and generalizability of the models considered, stratified five-fold cross-validation was applied. In each partition, the models were completely retrained, and the decision threshold was independently optimized using Youden’s index. The comparative results are presented in Table 7.

Table 7. Comparison under stratified cross-validation (5-fold) in Extended Scenario.

Model	AUC (Mean ± Std)	F1 (Mean ± Std)
Hybrid Neuro-Fuzzy-Inspired	0.9007 ± 0.0030	0.8222 ± 0.0020
MLP	0.844 ± 0.001	0.799 ± 0.002
Random Forest	0.8819 ± 0.0007	0.8034 ± 0.0007

The hybrid neuro-fuzzy-inspired model achieved the best overall performance (AUC = 0.9007 ± 0.0030; F1 = 0.8222 ± 0.0020), followed by Random Forest and MLP. Taken together, these results suggest that combining the tree ensemble with sigmoidal smoothing and neural meta-classification allows for better capture of the nonlinear patterns present in MQTT traffic associated with DDoS attacks in IoMT environments.

3.3.3. Bootstrap Confidence Intervals

To quantify the variability of performance under different subsets of the test set, a bootstrap procedure with 1000 iterations with replacement was applied to the hold-out set (30%). In each iteration, the AUC and F1-score metrics were calculated, and 95% confidence intervals were estimated using percentiles (2.5–97.5). The results are presented in Table 8.

Table 8. Bootstrap 95% confidence intervals for AUC and F1-score of the evaluated models.

Model	AUC (95% CI)	F1-Score (95% CI)
Hybrid Neuro-Fuzzy-Inspired	[0.9080–0.9100]	[0.8264–0.8292]
MLP	[0.8405–0.8430]	[0.7573–0.7604]
Random Forest	[0.8796–0.8816]	[0.8014–0.8043]

The hybrid neuro-fuzzy-inspired model exhibited the highest confidence intervals in terms of discriminant capability, with AUC values between 0.9080 and 0.9100 and F1-scores between 0.8264 and 0.8292, demonstrating high model stability under variations in the test set. The Random Forest model showed intermediate performance, while the MLP model presented the lowest values in both metrics. These results reinforce the consistency of the proposed hybrid approach compared to conventional machine learning models.

3.4. Sensitivity Analysis of the Model

3.4.1. Sensitivity of Parameter k

To analyze the influence of the sigmoidal smoothing parameter k on the performance of the proposed hybrid model, four configurations k ∈ {10, 20, 40, 60} were evaluated. In the first phase, the analysis was performed using the public DoS/DDoS-MQTT-IoT dataset to assess the model’s stability against variations in the hyperparameter k. The results are shown in Table 9.

Table 9. Sensitivity analysis of the parameter k using the public DoS/DDoS-MQTT-IoT dataset.

k	AUC	F1-Score
10	0.8777	0.8465
20	0.8778	0.8454
40	0.8772	0.8112
60	0.8777	0.8460

The results showed model stability, with minimal variations between configurations. In this scenario, the configuration k = 20 demonstrated the best balance between discriminant capacity and operational stability, with AUC ≈ 0.878 and F1 ≈ 0.845. However, a second analysis was performed using an extended dataset that incorporates traffic generated by ECG monitoring devices. The results are shown in Table 10.

Table 10. Sensitivity analysis of the parameter k in the extended scenario (dataset + ECG).

k	AUC	F1-Score
10	0.9041	0.8230
20	0.9042	0.8236
40	0.9046	0.8226
60	0.9044	0.8225

The AUC values remain within a very narrow range (0.9041–0.9046), indicating low sensitivity of the model to the parameter k.

3.4.2. Sensitivity of the Number of Trees

The results obtained are presented in Table 11. The AUC values remain practically constant across ensemble configurations (variations < 10⁻³). This behavior demonstrates high model stability in response to changes in the number of trees. To determine whether the observed differences were statistically significant, the non-parametric Kruskal–Wallis test was applied to the AUC values obtained in the cross-validation partitions. The result obtained (H = 0.744, p = 0.863) indicates that there are no statistically significant differences between the evaluated configurations. Since increasing the number of trees does not produce statistically significant improvements in model performance, the 30-tree configuration was selected as a compromise between modeling capacity and computational complexity.

Table 11. Sensitivity of the number of trees in the ensemble.

Trees	Fold 1	Fold 2	Fold 3	Mean AUC
10	0.897085	0.896795	0.897465	0.897114
20	0.897085	0.896794	0.897464	0.897114
30	0.897086	0.896794	0.897466	0.897116
40	0.897085	0.896795	0.897466	0.897115

Note: Kruskal–Wallis test, p = 0.862.

3.4.3. Tree Depth Sensitivity

To evaluate the influence of decision tree depth on model performance, a sensitivity analysis of the max_depth hyperparameter was performed, evaluating values between 4 and 40. The results are presented in Figure 7. As can be seen, model performance improves progressively with increasing tree depth, reaching a maximum AUC of 0.9095 for depths of 14 and 16. Beyond this point, further increases in depth do not improve performance and even produce a slight decrease in AUC. To avoid an unnecessary increase in model complexity, the 1% rule was applied, selecting the smallest depth whose AUC falls within 1% of the maximum value obtained. Based on this criterion, max_depth = 10 was selected for the final model implementation.

Figure 7. Sensitivity analysis of tree depth on model performance. The solid line represents AUC values at different tree depths, and the dashed vertical line indicates the selected optimal depth.

3.5. Real-Time Evaluation of the IDPS

3.5.1. Computational Cost and Processing Latency

To evaluate the computational cost introduced by the proposed IDPS, a resource monitoring experiment was conducted on the server where the system was deployed. The tests were carried out in an experimental IoMT environment consisting of five ECG monitoring devices connected to the MQTT broker, which periodically transmitted telemetry to the platform.

(i)

Baseline system operation without the IDPS active,

(ii)

IDPS running without traffic,

(iii)

IDPS processing legitimate traffic from ECG devices, and

(iv)

IDPS operating under attack conditions.

During each scenario, system metrics such as CPU usage, RAM consumption, and model inference latency were recorded using a monitoring script that collected operating system information at one-second intervals for 300 s per scenario. The results are shown in Table 12.

Table 12. Resource Consumption and Performance Indicators.

Scenario	Average CPU (%)	Maximum CPU (%)	Average Inference Latency (ms)
Baseline (Without IDPS)	4.07	24.0	N/A
IDPS Idle	4.03	12.7	3.11
IDPS + Legitimate ECG	5.60	15.2	3.53
IDPS + DDoS Attack	9.77	45.2	0.19

The detailed distribution of CPU usage in these scenarios is presented in Figure 8, confirming that the system does not saturate server resources even under stress. On the other hand, Figure 9 illustrates the scalability analysis, where it can be seen that despite the massive increase in packets during an attack, the inference latency decreases to 0.19 ms thanks to the optimization of the proposed model.

Figure 8. CPU utilization across evaluated scenarios. The boxes represent the interquartile range (25th–75th percentiles), the horizontal orange lines indicate the median, and the circles indicate outliers that exceed 1.5 times the interquartile range.

Figure 9. Inference latency vs. network traffic load.

In addition to the empirical evaluation, an analytical scalability approximation was conducted based on the observed computational behavior of the system. Given that the proposed architecture exhibits linear computational complexity, O(n), with respect to the number of concurrent traffic flows, the scalability can be estimated from the measured resource consumption.

Under normal operating conditions with five IoMT devices, the system reported an average CPU usage of 5.60%. Assuming a linear relationship between the number of devices and computational load, an approximate per-device cost of 1.12% CPU can be derived. This approximation provides an indicative scaling factor for the evaluated deployment environment.

Based on this linear model, a first-order extrapolation suggests that the evaluated VPS infrastructure could support dozens of concurrent devices (approximately 50–80) before approaching CPU saturation, depending on traffic intensity and attack conditions. In addition, the inference latency remained stable (≈3.53 ms), indicating that real-time processing performance is preserved as the number of devices increases within this range.

3.5.2. Detection and Mitigation Performance

The system’s behavior was evaluated under both legitimate ECG traffic and flooding attack scenarios. During testing, traffic generated by ECG devices was not blocked, confirming that the proposed model accurately distinguishes between normal biomedical activity and malicious traffic patterns.

Upon the initiation of an attack, the system detected flow anomalies in less than one second, producing scores that exceeded the predefined decision threshold. Following detection, the cumulative decision mechanism incremented the counter of consecutive anomalous events, enabling robust discrimination between persistent attacks and transient network fluctuations.

This strategy allows the system to tolerate short-lived traffic bursts, such as those caused by device reconnection or synchronization processes, without triggering false positives. Once the threshold of 10 consecutive detections is reached (ATTACK_REPEAT_LIMIT = 10), the system automatically applies a mitigation rule by blocking the corresponding source IP address.

The experimental results demonstrate that the proposed IDPS provides timely detection and effective mitigation while preserving legitimate IoMT communications, ensuring stable operation under both normal and adversarial conditions.

4. Discussion

The literature has documented that DDoS attack detection in IoT environments can be performed using features extracted from both the application and network layers [39,40,41,42]. However, several of these approaches focus primarily on identifying the attack once the traffic has reached specific services or applications. The results obtained in this study, suggest that, in flooding scenarios targeting MQTT brokers, resource saturation can occur at early stages of the communication flow [43]. Consequently, mitigation mechanisms based exclusively on the application layer may be activated when network resources are already partially compromised.

In this context, the use of flow metrics derived directly from network traffic allows for the capture of early variations in the temporal and volumetric behavior of packets. The statistically significant differences observed between flooding_basic and flooding_delayed confirm that temporal variables such as IAT and transmission rates contain discriminating information for characterizing attack patterns [44,45]. The experimentally observed detection and mitigation times (<3 s for detection and 10–15 s for blocking) indicate that the system can identify anomalous traffic patterns on timescales compatible with the communication dynamics of IoMT environments. In this type of infrastructure, characterized by resource-constrained devices and continuous data flows, several studies indicate that security mechanisms should operate using lightweight approaches capable of reacting quickly to variations in network traffic [15,18]. Furthermore, recent work on DDoS attack detection in IoT environments highlights that machine learning-based models can identify attack patterns from flow characteristics without requiring in-depth application analysis, allowing for the detection of anomalies in the early stages of traffic [14,22,46,47]. In this context, the results obtained suggest that the use of flow metrics can facilitate the early identification of behaviors associated with flooding attacks targeting MQTT services.

A conceptual comparison with the Sugeno-type ANFIS model suggests that this approach can achieve adequate performance when applied under controlled configurations, generally supported by careful preprocessing and reduced feature sets. However, several studies indicate that, in IoT environments characterized by dynamic traffic and low-throughput attacks [32,46,47], the generalization capacity of ANFIS systems can be affected due to the increasing number of fuzzy rules required to model multiple continuous variables. In contrast, the proposed hybrid model learns nonlinear relationships directly from the data by combining an ensemble of trees with a neural meta-classifier, thus avoiding the explicit definition of fuzzy rules.

When comparing the results obtained with the state of the art, relevant methodological differences are identified between existing approaches and the proposal presented in this study, which are summarized in Table 13. Studies such as [48]. report high accuracy (97.82%) in controlled environments using highly complex neuro-fuzzy-inspired models based on a large number of rules (1024). However, according to the configuration reported by the authors, these models are primarily geared towards experimental or offline scenarios, which may hinder their deployment in IoMT environments characterized by limited computational resources.

Table 13. Technical comparison between the proposed approach and related work.

Metric/Study	Research [48]	Research [49]	Proposed Approach
Operating layer	Network/Application layer	Network layer using SDN	Network layer (packet-level analysis)
Number of features	~10 traffic variables	~6 network variables	4 features (IAT, pkt_rate, bytes_rate, frame.len)
Neuro-fuzzy-inspired model	Classical Sugeno ANFIS	ANFIS integrated with SDN architecture	Hybrid decision-tree ensemble with sigmoidal smoothing and MLP meta-classifier
Dataset used	CIC-DDoS-2019	CIC-DDoS-2019	DoS/DDoS-MQTT-IoT + ECG traffic
Target protocol	General network traffic	TCP SYN Flood	MQTT (biosignal telemetry)
Evaluation scenario	Experimental/offline environment	SDN environment in fog computing	IoMT environment with operational implementation
Model complexity	Large number of fuzzy rules	Dependence on SDN controller	Lightweight model based on flow metrics
Infrastructure requirements	Computational resources not constrained	Dedicated SDN infrastructure	VPS with limited resources
Key outcome	Classification based on fuzzy rules	Detection and mitigation using SDN	Early detection and automatic mitigation at the network level

The approach proposed in this work integrates detection and mitigation mechanisms directly into the network layer using an IDPS, enabling the application of automated countermeasures without the need for additional infrastructure. This resulted in detection times of less than three seconds under operational conditions, which is particularly relevant in IoMT environments. In contrast, Ref. [49] base their proposal on an external infrastructure supported by software-defined networking (SDN), which introduces additional network control requirements and greater architectural complexity to the system.

Furthermore, the proposed system operates exclusively with observable metrics at the network level, without requiring deep packet inspection or specialized infrastructure. In line with previous studies that demonstrate the viability of lightweight models for detecting DDoS attacks on MQTT [40,50], the results obtained confirm that it is possible to integrate early detection, effective mitigation, and low computational cost into a single system geared toward IoMT environments with limited resources.

Limitations of the Study

The transition to a real-world production environment required a redefinition of the feature set. While the initial dataset included detailed traffic capture attributes, real-time execution demanded prioritizing metrics continuously observable at the network level. This decision, while ensuring operational feasibility, highlights a necessary trade-off between descriptive richness and implementation feasibility. This same approach applies to the scalability analysis, which is based on an analytical approach that assumes homogeneous traffic and ideal linear scalability. Consequently, these results represent a theoretical estimate of capacity and require further large-scale stress testing to validate system behavior under nonlinear network variables and high-density IoMT deployment conditions.

5. Conclusions

This study proposes a hybrid neuro-fuzzy-inspired approach for detecting distributed denial-of-service (DDoS) attacks in IoMT environments based on the MQTT protocol. The architecture integrates an ensemble of decision trees with sigmoid smoothing and a multi-layer neural meta-classifier, allowing for the modeling of gradual transitions between legitimate and malicious traffic without requiring explicit fuzzy rules or conventional fuzzy inference processes.

Experimental results obtained with the public DoS/DDoS-MQTT-IoT dataset demonstrated that the proposed model achieves competitive performance compared to traditional machine learning models. In particular, the hybrid approach achieved AUC values close to 0.90 and F1 values above 0.82 in the extended scenario, consistently outperforming MLP and showing superior performance to Random Forest in terms of the balance between accuracy and sensitivity.

Statistical validation using stratified (5-fold) cross-validation and bootstrap with 1000 iterations confirmed the model’s stability against variations in the training and test subsets. The confidence intervals obtained demonstrate low dispersion in the performance metrics, indicating adequate generalizability for dynamic IoT traffic scenarios.

Additionally, incorporating real traffic from electrocardiographic monitoring devices allowed for evaluating the system’s behavior under conditions closer to real-world IoMT environments. In this scenario, the model maintained a high capacity for discriminating between legitimate and attack traffic, demonstrating robustness against the variability introduced by biosignals transmitted via MQTT.

Implementing the model within an intrusion detection and prevention system (IDPS) allowed for validating its real-time operation. Experiments showed that the system is capable of detecting attack patterns in a few seconds and applying automatic mitigation mechanisms at the network level, blocking malicious IP addresses without interrupting the transmission of legitimate physiological data. As a future line of research, it is proposed to expand the evaluation of the system by incorporating other types of application layer attacks and large-scale multi-device scenarios, as well as exploring continuous learning techniques that allow the model to adapt to dynamic changes in IoMT traffic patterns.