In the e-Health domain, new and continuously evolving threats emerge every day. The security of e-Health telemonitoring systems is no longer negligible. In this paper, we propose a Cyberattack Detection System (CADS) model that exploits artificial intelligence techniques to detect anomalies without requiring a security analyst, explain the malicious activity, and display suspected attack data to healthcare personnel for feedback. The system description is contextualized to the case of the hacked remote patient health telemonitoring.
relevant to the incident and understand why it happened [5]. Although security tools that provide visualization techniques and minimize human interaction have been developed to make the analysis process easier, too little attention has been given to making human-friendly the interpretation of security incidents. Simply reporting a cyberattack in written format is not enough to enable the healthcare professional to correct the patient’s Clinical Pathway. This data must be represented in a graphical way, which can be grasped by the healthcare provider. The detection of the cyberattack must therefore be supported by systems that provide diferent forms of explanation, depending on the diferent end users, and that allow these users to have the possibility to interactively manipulate graphical representations based on Visual Data Mining techniques.
The Internet of Things (IoT) has transformed hospital settings and created a new moniker for the healthcare world, The Internet of Medical Things (IoMT). Ensuring a security mechanism for IoMT, which uses appropriate analytical tools in a distributed working architecture, also capable of analyzing huge data (i.e., big data) generated by IoMT devices in a distributed manner, is a challenging issue. In this paper, we present a cyberattack detection model that implements eXplainable AI (XAI) functionality to support caregivers in grasping that an attack has occurred to the telemonitoring system and its efect on the patient’s Clinical Pathway. The main contribution is a Cyberattack Detection System that is able to identify compromised data during a cyberattack and support the caregiver to fix the problem. In this paper, we focus on the case where an IoMT system has been hacked, with the malicious intent of manipulating health data, in order to trigger bogus care countermeasure.
The remainder of the present work is as follows. Section 2 provides an overview of related work and technologies which were investigated as background knowledge, namely, cyberattack detection systems, anomaly-based intrusion detection systems, anomaly detection in e-Health and IoMT with AI techniques. Section 3 describes the architecture of our proposal, i.e. a Cyberattack Detection System with an anomaly detector, an explanation module and a user interface engine, showing a possible scenario of application specifically designed for our approach. Finally, Section 4 concludes the paper, outlining future works.
Cyberattack detection can be defined as the problem of identifying individuals who are using a computer system without authorization, those who have legitimate access to the system but are abusing their privileges, and, in general, the identification of attempts to use a computer system without authorization or to abuse existing privileges.
In this landscape, modern cyberattack detection systems monitor either host computers or network links to capture cyberattack data. Host intrusion detection refers to the class of intrusion detection systems (IDS) that reside on and monitor an individual host machine [6]. There are a number of system characteristics that a host intrusion detection system (HIDS) can make use of in collecting data [7]. A network intrusion detection system (NIDS), instead, monitors the packets that traverse a given network link. Such a system operates by placing the network interface into promiscuous mode, afording it the advantage of being able to monitor an entire network while not divulging its existence to potential attackers [8].
Cyberattack Detection System (CADS) is software that automates the cyberattack detection process and detects possible cyberattacks. Cyberattack Detection Systems serve three essential security functions: they monitor, detect, and react to unauthorized activity by company insiders and outsider cyberattack. One of the major approaches to cyberattack detection is Anomaly Detection. It assumes that a cyberattack will always reflect some deviations from normal patterns. In this sense, Anomaly-based IDS compares a model of normal behavior against the incoming trafic in order to find anomalies [9, 10].
Once an intrusive incident has been reported by means of a correct detection, the reaction phase has to be fired, evaluating the impact of this event on the security level of the system [ 11]. It must provide the set of countermeasures to quickly eradicate the cyberattack and, at the same time, indicate the set of actions to heal the system and bring it back to its normal state. A possible way to react is via the use of Intrusion Response Systems (IRSs), as they are IDSs capable of counteracting suspicious activities [12]. Although intrusion response components are often integrated with the detection ones, they have received considerably less attention than IDS research.
Anomaly Detection typically operates on monitored networked trafic data. Actually, continuous monitoring is the main activity of modern e-Health technologies, ranging from devices that monitor health and deliver medication, to telemedicine delivering care remotely. Indeed, the integration of healthcare-based devices and sensors within IoT, led to the evolution of IoMT [13]. Therefore, IoMT-enabled devices have made remote monitoring possible in the healthcare sector, enabling the ability to keep patients safe, and inspiring doctor to provide superlative treatment [14]. As a result, the increasing demands and expansion of IoMT systems require advancements in data storage methods, data processing and cybersecurity related issues.
Healthcare providers can then provide eficient remote healthcare communication for monitoring and diagnosis services to the residents of these smart communities. Any security threat to these systems may cause a serious problem, such as imposing a false diagnosis or delaying the interaction. This leads to a violation of patients’ privacy, health issues, and even death in extreme cases [15]. AI and Machine Learning (ML) have been largely employed for managing issues in healthcare systems as they are the most promising techniques to be used for previously unseen attacks [16]. It can identify attacks simply by monitoring data alteration or by detecting changes in the network’s trafic characteristics. In particular, ML-based anomaly detection systems are crucial to ensure security and mitigate threats such as false data injection attacks [17]. IoMT systems are widely distributed and are collections of heterogeneous sensors. Attack detection in IoMT is entirely diferent from the present security mechanism, due to the special services required by IoMT such as: computing power, memory space, battery life, low latency, and network bandwidth, which cannot get fulfilled by the centralized conventional approach of standalone cloud computing [18]. In cloud computing architecture, data generated by IoMT devices is being transmitted to and from the cloud in order to provide services to the healthcare users. The limitations of traditional standalone cloud solutions is that the data recovery time is too high for a real-time emergency situation, such as fall detection or stroke prevention, which mostly needs rapid response time from medical professionals [19].
Therefore, designing a distributed security framework, for distributed IoMT applications is a
challenging task due to the dynamic nature of IoMT network such as IoT devices, edge devices,
and cloud. Moreover, the evolution of attacker behavior can intercept the transmission network
in IoMT [20]. The line of research in this way is going towards constructing robust
anomalybased IDSs that eficiently distinguish attack and normal observations in IoMT environment,
consisting of interconnected devices and sensors, with poor design and weak authentication
measures. As stated in [
⊥ ECG set ECG⊥
ECG⊥t indexes
ASCU d e r u t rtcuS taaDECGi
indexes
CP set ECG⊥ ECG⊥t
inAAdSeSGxCeUUs (RXeSseuclt)s
φi
including, in addition to the identification of anomalous data, an explanation of the possible
motivations for classifying such data as anomalous, and the possibility for a domain expert to
validate data through their visual interactive representation. Anomalous data, which represent
an intrusion in a hacked system, are explained according to the Explainable Security (XSec)
paradigm [
Our system is beneficial in e-Health scenarios, supporting the patient who is in
homebased healthcare. The technological infrastructure, based on the architecture presented in [
The proposed Cyberattack Detection System implements cybersecurity methods to identify
which data were compromised after the system is hacked. Moreover, it provides an explanation
of the cyberattack and enables interaction with the detected anomalies which may occur in the
remote and continuous patient monitoring and care phases. In particular, the anomaly detection
phase is carried out by the CPAD module, whose formalization, already tailored in the healthcare
domain, was introduced in [
In the following, a running example in which an e-Health telemonitoring system has been hacked is reported. It describes how the proposed Cyberattack Detection System is able to highlight the cybersecurity threats and the related countermeasures to solve the hack and restore the system. A male patient who is following a certain CP is monitored. He sufers from Congestive Heart Failure and his CP requires that his heartbeats are monitored every 15 minutes. A smart end-device that measures the ECG is used. Hence, the proposed system, suitably connected to the end-device, receives data about the patient pulse. The gathered heartbeats are fed to the CPAD module that determines whether anomalous measurements occur, suggesting that the telemonitoring system has been hacked. Since heartbeats measures are a key factor in determining the clinical picture of a patient, a compromised flow of measurements would endanger the patient’s CP and induce a wrong handling of the patient’s health.
The Cyberattack Detection System is designed to be modular and can be integrated with various IoMT devices that use Bluetooth technology. An API gateway is responsible of the correct integration of the end-device with the Cyberattack Detection System. In particular, the API gateway checks the compliance of the gathered data to be fed into the system. By means of specifically designed APIs, input data are normalized according to the system standards, allowing the correct exchange of information between the devices and the software modules, also converting unstructured data into structured ones.
Referring to the running example, in which a smart ECG monitoring end-device is connected
via IoMT with the Cyberattack Detection System, the following definition to formally handle
data inflow is proposed.
Definition 1. Let be the data-flow of a smart ECG monitoring end-device, be the
heartbeat information coming from at a certain timestamp . The -th heartbeat detection
is defined as follows:
= ( ), with ∈ R and ∈ [1, ], ∈ R
(1)
The variable indicates the count-based feature representing the value of the -th sampling
step in a given timestamp, which can be assumed as a real value (,) ∈ R, representing the
amount in milliVolt (mV) of the count-based feature. Therefore, the representation of the ECG
data can be formalized as in Table 1.
3.1. ECG Anomaly Detection
The proposed system, through the use of AI techniques, contributes to improve the security of
the telemonitoring infrastructure. Once the data have been transformed into a structured form,
they are given as input to the CPAD which analyzes the structured data according to Table 1
format, and checks in which point the cyberattack has been launched by retrieving the anomaly.
The CPAD module is based on Robust Deep Autoencoders (RDA) [
In the running example, in which it is assumed that a cyberattack on ECG measurements is going on, a delayed threat reaction would compromise the patient’s care pathway. By exploiting RDA for anomaly detection, the CPAD modules ensure a rapid response in terms of inference time, quickly detecting anomalous ECG data. In particular, the CPAD module categorizes ECG data with a simple binary classification according to whether they have been identified as anomalous or not. Actually, in the medical literature [37], heartbeats can be classified into five diferent types: 1. (N) - Normal; 2. (RonT) - Premature Ventricular Contraction; 3. (PVC) - Premature Ventricular Contraction; 4. (SP) - Supra Ventricular; 5. (UB) - Unclassified Beat.
Therefore, the classification process can be further specified by dividing the normal heartbeats from the others, and then dedicate another RDA classifier to detect the remaining four diferent types of anomalies. In particular, the CPAD module defines three sets of classified ECG data: • ⊤: instances classified by CPAD as normal, i.e. not anomalous; • ⊥: instances classified by CPAD as anomalous; • ⊥ : instances of anomalous ECG, with ∈ {(RonT), (PVC), (SP), (UB)}.
Once the structured data have been processed, the CPAD produces a CSV file containing all the instances classified by CPAD as anomalous ⊥, i.e. all the heartbeats that are anomalous. A confusion matrix is also showed, in order to have a clearer view of performance classification, both in terms of predictability power and efectiveness of the learned model. To address the anomaly detection problem, the RDA method based on the autoencoder approach is exploited. It is based on a training pipeline, where examples of anomalies are provided during model training. The result is evaluated on sets consisting of anomalous and normal (i.e., non-anomalous) data. In the end, the CPAD module separates the predicted instances into the three diferent sets of heartbeat anomalies, namely ⊤, ⊥, and ⊥ . 3.2. ECG Explanation After the anomaly detection, the next step is to interpret and explain the sets that CPAD has created, to understand why certain instances have been classified as anomalous. In systems using Explainable AI (XAI) algorithms, additional data coming from the Machine Learning process may be useful explanations, produced by the system itself to enrich the predicted instances with a plausible rationale. In Information Security, instead, explanations are provided by the designers. However, the role of Explanations is crucial in AI field. Consequently, Information Security kept all advantages from that, for example, ensure the user trust concerning the system. Explanations are therefore designed to bridge the gap between “actual safety” and “perceived safety”.
To this end, the Explainer module of our Cyberattack Detection System receives as input the th ECG instance () from the API Gateway, and also the output of the CPAD, appropriately separated in the three sets ⊤, ⊥, and ⊥ . Exploiting the XSec paradigm, the aim is to obtain its “six W ” (Who? What? Where? When? Why? and How?) that give a complete view of the identified and perceived anomaly. XSec involves several actors (e.g., in this case we have security analysts, doctors, nurses, and the patient). It requires a dedicated reasoning tool to infer about the system model, the threat model, and properties of security, privacy, and trust, as well as concrete cyberattacks, vulnerabilities, and countermeasures.
In addition to the XSec paradigm, two specifically designed indexes, called respectively Anomaly Score General Unsafe (ASGU) and Anomaly Score Class Unsafe (ASCU), are introduced. First, we formally define the ASGU index as follows.
Definition 2. Let be the set of heartbeat detections received from a smart ECG monitoring
end-device, be the -th heartbeat detection, and ⊥ the set of all anomalous instances.
Then, the Anomaly Score General Unsafe index is a function ASGU : ↦→ [
Hence, the higher the ASGU score value, and thus closer to 2, the more anomalous the heartbeats will be considered. The ASCU index, instead, is based on the comparison with one of the four classes of anomalies.
Definition 3. Let be the set of heartbeat detections received from a smart ECG monitoring
end-device, be the -th heartbeat detection, and ⊥ a set of a class of anomalous
instances, with ∈ {(RonT), (PVC), (SP), (UB)}. Then, the Anomaly Score Class Unsafe index is
a function ASCU : ↦→ [
In this case, the higher the value of the ASCU score, and therefore the closer to 1, the more abnormal the heartbeats will be in the set of heartbeats of the same class ⊥ . The goal of these two indexes is to quantify the strength of a feature in contributing to determine an anomaly in the ECG data. This would give a further useful information to characterizing the detected anomaly, and such information can be assumed as part of the explanation to be addressed together with the XSec approach.
In the running example, the Explaination module receives as input the CSV file containing the instances and provides in output another CSV file composed of four columns: • : -th instance classified by the CPAD as anomalous; • CLASS: the corresponding class ∈ {⊥ } of the -th instance; • ASGU: the Anomaly Score General Unsafe score; • ASCU: Anomaly Score Class Unsafe score.
The Explanation module, therefore, acts in two conjunct phases: the first one takes place following the generation of the CSV file containing the information and indexes mentioned above (, CLASS, ASGU and ASCU); the second one results from the information generated by the XSec approach, which will be displayed in the Visualization Framework. Thanks to the combination of the XSec paradigm and the two indexes ASGU and ASCU, the Cyberattack Detection System provides the doctor with a concise explanation of why the -th detection has been classified as anomalous.
Following the Explanation, it is possible to check whether the Clinical Pathway that has been generated is correct or not. An incorrect CP has a double meaning: from a clinical point of view, it is a serious problem for the patient’s health while, from the cybersecurity point of view, it means that the system has been hacked. 3.3. ECG User Interaction In our case study, the contribution of the User Feedback to the system is the evaluation of a the detected anomaly and the embedding of a doctor’s feedback. The User Feedback module will generate for each detection a feedback coeficient that represents the doctor’s feedback on a given instance. is defined as follows: Definition 4.
Let be the set of the heartbeat detections received from a smart ECG monitoring end-device, be the -th heartbeat detection. Then, the feedback coeficient is a function : ↦→ {− 1, 1} such that any -th user feedback related to the heartbeat detection , = ︂{ +1 if is false positive or false negative if is true positive or true negative Therefore, the User Feedback is a set of tuples such that, for any -th pair of arguments (, ), a single element is defined as: (2) (3) = (, )
In this way, the Cyberattack Detection System will become more robust to external cyberattacks, since the User Feedback would report the opinion of the caregiver which will confirm or not whether the -the ECG detection is abnormal or not. In the User Interaction Engine, the Visualisation Framework represents the data orchestrator, handling and visualizing processed data coming from the various modules. It uses algorithms of Visual Data Mining (VDM) [38, 39] that allow, through diferent visualisation techniques, to interactively group data in a more eficient way, improving the data insight process.
Afterwards, the User Interface (UI) included in the User Interaction Engine allows the user to interact with the data. In the running example, the UI allows the caregiver to interact with the ECG instances. After the Explanation module has displayed the result of the XSec paradigm, it is possible to visually manage each ECG detection. For instance, one would be able to no longer consider an ECG instance as an anomaly, or, more specifically, to improve the classifier performances by indicating the correct class of anomaly among the four types ⊥ when a wrong one has been predicted. The interaction with the user, in this case a doctor, helps the system to be more and more reliable, as well as secure from cyberattacks.
Through the integration of CPAD, Explainer, and User Engine Interface modules, the Visualization Framework will be able to manage anomalies detected as Threat Insight. These will be appropriately displayed on the UI which, in addition to allowing interaction with the anomalous data (in this case the ECG detection), will be able to display the threat representation through a dashboard. Thanks to the threats graphical representation in the dashboard, the user’s reaction to the threat is improved.
In the e-Health domain, new and continuous evolving threats emerge every day. The security of e-Health telemonitoring systems is no longer a negligible task. The proposed Cyberattack Detection System, thanks to the use of AI techniques, is able to protect the e-Health system from cyberattacks by automatically identifying the anomalies in the e-Health system, without the need of a dedicated security analyst.
The solution is focused on the task of cyberattack detection, in the particular case of exploiting a remote patient telemonitoring system that has been hacked. A specific running example, i.e. the heartbeat telemonitoring, has been considered.
The presented system is designed to automatically detect the anomaly by means of Deep Learning techniques. In particular, a Robust Deep Autoencoder detects anomalous heartbeats instances. The detected anomalous heartbeats are subsequently interpreted with a combination of state-of-the-art explainable security paradigms (XSec) and with two new explainable scores which have been introduced, showing to the user the reasons of a malicious activity interfering with the heartbeats telemonitoring. Further, the systems visually represent the results to the user who is engaged in a feedback response: if the detected anomalous data are truly atypical, the user assess the detection with a positive feedback coeficient, i.e. a new metric involved in the process of user interaction with the system. Otherwise, the user provides a negative feedback coeficient. Such an interaction with the Cyberattack Detection System proposed has an impact on the processed health data, adjusting the visualization reports with the corrected measurements, shown in a useful dashboard.
The proposed work witnesses how the wide range of AI techniques are already dramatically important in the hot topic of Cybersecurity, in particular when applied to eHealth domain. The efectiveness of AI algorithms in identifying threats, and the consequent eficiency in significantly reducing the user’s reaction time, are becoming fundamental properties to be taken into account when designing a Cyberattack Detection System. For these reasons, Threat Intelligence is increasingly becoming a tool for enhancing system security and performing automatic threat analysis. Indeed, Threat Intelligence uses diferent data sources (in this case data from diferent IoMT sensors) to proactively identify and mitigate threats to improve the security of the patient telemonitoring system. Overall, the presented system suggests how it is possible to improve user reaction to threats in healthcare telemonitoring systems using AI techniques.
Future work will be devoted to the integration of other IoMT sensors and, hence, to the anomaly detection of other vital parameters.
This work was partially funded by the European Union, Horizon 2020 research and innovation programme, through the ECHO project (grant agreement no 830943) and by the Italian P.O. Puglia FESR 2014 – 2020 (project code 6ESURE5) SECURE SAFE APULIA. [4] A. Holzinger, G. Langs, H. Denk, K. Zatloukal, H. Müller, Causability and explainability of artificial intelligence in medicine, Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery 9 (2019) e1312. [5] N. AfzaliSeresht, Q. Liu, Y. Miao, An explainable intelligence model for security event analysis, in: Australasian Joint Conference on Artificial Intelligence, Springer, 2019, pp. 315–327. [6] S. Singh, S. Silakari, A survey of cyber attack detection systems, International Journal of
Computer Science and Network Security 9 (2009) 1–10. [7] J. Raiyn, et al., A survey of cyber attack detection strategies, International Journal of
Security and Its Applications 8 (2014) 247–256. [8] B. Mukherjee, L. T. Heberlein, K. N. Levitt, Network intrusion detection, IEEE network 8 (1994) 26–41. [9] A. C. Kim, W. H. Park, D. H. Lee, A study on the live forensic techniques for anomaly detection in user terminals, International Journal of Security and Its Applications 7 (2013) 181–188. [10] D. J. Weller-Fahy, B. J. Borghetti, A. A. Sodemann, A survey of distance and similarity measures used within network intrusion anomaly detection, IEEE Communications Surveys & Tutorials 17 (2014) 70–91. [11] M. Gunasekharan, S. Basu, G. R. Santhanam, Selecting the minimal set of preferred responses to counter detected intrusions, in: Proceedings of the 12th Annual Conference on Cyber and Information Security Research, 2017, pp. 1–8. [12] S. A. Zonouz, H. Khurana, W. H. Sanders, T. M. Yardley, Rre: A game-theoretic intrusion response and recovery engine, IEEE Transactions on Parallel and Distributed Systems 25 (2013) 395–406. [13] G. Yang, M. A. Jan, V. G. Menon, P. Shynu, M. M. Aimal, M. D. Alshehri, A centralized cluster-based hierarchical approach for green communication in a smart healthcare system, IEEE Access 8 (2020) 101464–101475. [14] H. Zhu, C. K. Wu, C. H. Koo, Y. T. Tsang, Y. Liu, H. R. Chi, K.-F. Tsang, Smart healthcare in the era of internet-of-things, IEEE Consumer Electronics Magazine 8 (2019) 26–30. [15] H. Fotouhi, A. Causevic, K. Lundqvist, M. Björkman, Communication and security in health monitoring systems–a review, in: 2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC), volume 1, IEEE, 2016, pp. 545–554. [16] A. L. Buczak, E. Guven, A survey of data mining and machine learning methods for cyber security intrusion detection, IEEE Communications surveys & tutorials 18 (2015) 1153–1176. [17] Y. Luo, Y. Xiao, L. Cheng, G. Peng, D. D. Yao, Deep learning-based anomaly detection in cyber-physical systems: Progress and opportunities, arXiv preprint arXiv:2003.13213 (2020). [18] A. Alrawais, A. Alhothaily, C. Hu, X. Cheng, Fog computing for the internet of things:
Security and privacy issues, IEEE Internet Computing 21 (2017) 34–42. [19] S. Singh, Y.-S. Jeong, J. H. Park, A survey on cloud computing security: Issues, threats, and solutions, Journal of Network and Computer Applications 75 (2016) 200–222. [20] R. Priyadarshini, M. R. Panda, B. K. Mishra, Security in healthcare applications based on fog and cloud computing, Cyber Security in Parallel and Distributed Computing: Concepts, 2018 Wireless Telecommunications Symposium (WTS), 2018, pp. 1–5. [34] C. Zhou, R. C. Pafenroth, Anomaly detection with robust deep autoencoders, in: Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining, 2017, pp. 665–674. [35] M. Sakurada, T. Yairi, Anomaly detection using autoencoders with nonlinear dimensionality reduction, in: Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, 2014, pp. 4–11. [36] R. C. Aygun, A. G. Yavuz, Network anomaly detection with stochastically improved autoencoder based models, in: 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing (CSCloud), 2017, pp. 193–198. [37] I. Christov, G. Bortolan, Ranking of pattern recognition parameters for premature ventricular contractions classification by neural networks, Physiological Measurement 25 (2004) 1281. [38] A. Hinneburg, D. A. Keim, M. Wawryniuk, Hd-eye: visual mining of high-dimensional data, IEEE Computer Graphics and Applications 19 (1999) 22–31. [39] M. Kreuseler, T. Nocke, H. Schumann, A history mechanism for visual data mining, in: IEEE Symposium on Information Visualization, 2004, pp. 49–56.