Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments

Computer Science > Cryptography and Security [Submitted on 1 Aug 2026] Explainable Hybrid Feature Selection for Intrusion Detection in Internet of Medical Things Environments Amira Berrezzek, Hayet Djellali, Giulio Mallardi, Lamia Mahnane Internet of Medical Things (IoMT) networks are hard to protect: devices are heterogeneous, computing resources are scarce, and traffic must be analyzed in real time. We present an intrusion detection system that addresses these constraints through feature selection. A Pearson correlation filter first removes redundant attributes; a hybrid strategy then combines model-based feature importance with SHAP attribution to pick a compact subset, on which we train Random Forest and LightGBM classifiers. SHAP and LIME explain what each retained feature contributes to the decisions. On CIC-IoMT 2024 and CIC-IDS 2017, the method cuts the feature space by up to 88% - from 40 to as few as 5 features - and accuracy and F1-score stay within a few points of models trained on all features. Compact, interpretable detectors of this kind are practical candidates for deployment on resource-limited medical networks. Comments: 6 pages, 9 figures Subjects: Cryptography and Security (cs.CR); Machine Learning (cs.LG) Cite as: arXiv:2608.00869 [cs.CR]   (or arXiv:2608.00869v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2608.00869 Focus to learn more Submission history From: Giulio Mallardi [view email] [v1] Sat, 1 Aug 2026 21:10:24 UTC (273 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-08 Change to browse by: cs cs.LG References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)