Neuro-Fuzzy Approach for Detecting DDoS Attacks in IoT Environments Applied to Biosignal Monitoring

Distributed denial-of-service (DDoS) attacks pose a critical threat to the availability of the Internet of Medical Things (IoMT). This paper proposes an intrusion detection system (IDS) based on a hybrid neuro-fuzzy-inspired approach to identify DDoS attacks in IoMT environments. The architecture combines an ensemble of decision trees, a sigmoidal smoothing mechanism, and a multilayer neural meta-classifier, enabling the modeling of nonlinear relationships between legitimate and malicious traffic without requiring explicit fuzzy rules or a formal fuzzy inference mechanism. The evaluation was conducted using the public DoS/DDoS-MQTT-IoT dataset, which was extended by incorporating legitimate traffic generated by electrocardiography (ECG) monitoring devices to approximate real operational IoMT conditions. The model was validated using stratified cross-validation and bootstrap procedures. In the extended IoMT scenario including ECG traffic, the proposed approach achieved an area under the ROC curve (AUC) of 0.904 and an F1 score of 0.823. Finally, the IDS was integrated into an intrusion detection and prevention system (IDPS) capable of detecting anomalous traffic patterns within three seconds and automatically blocking malicious IP addresses after repeated detections.