Multimodal behavioral fingerprinting of IoMT devices a forensic approach using network and biometric signatures

Abstract

The Internet of Medical Things (IoMT) has revolutionized healthcare by enabling continuous remote patient monitoring; however, it has also introduced critical vulnerabilities where cyber-attacks can directly threaten patient safety. Traditional digital forensics as well as intrusion detection systems (IDS) largely rely on the unimodal analysis of network traffic, which focuses on packet headers and flow statistics. While effective against volumetric attacks, these methods fail to detect "semantic" attacks specifically Data Alteration where adversaries manipulate patient vitals while adhering to standard communication protocols. To address this forensic gap, this research proposes the Multimodal Behavioral Fingerprinting Framework (MBFF). Unlike existing approaches, MBFF constructs a composite device signature by employing an Early Orthogonal Feature Fusion mechanism that integrates Network Flow Metrics $$\left({\text{V}}_{\text{n}\text{e}\text{t}}\right)$$ with Biometric Payload Data $$\left({\text{V}}_{\text{b}\text{i}\text{o}}\right)$$ , creating a dependency check between the transmission behavior and the physiological data content. The framework is validated using the WUSTL-EHMS-2020 dataset, a realistic IoMT testbed containing 16,318 flow instances with significant class imbalance. Experimental results demonstrate that the proposed multimodal approach achieves an overall accuracy of 93.11%. Most significantly, the model overcomes the "context blindness" of previous works by achieving a near-perfect F1-Score of 0.99 for detecting Data Alteration attacks, which are typically invisible to network-based forensics. These findings confirm that integrating physiological context into digital forensics is essential for distinguishing between technical malfunctions and malicious data injection, providing investigators with high-fidelity evidence for post-incident attribution.