Network and Biometric Signatures Combined to Fingerprint Hacked Medical Devices

Medical devices connected to hospital networks can be hacked in a way that leaves the network itself looking perfectly normal. A compromised sensor may keep sending packets at the right intervals and sizes, adhering to every communication protocol, while the payload inside those packets carries a manipulated heart rate or a physiologically impossible oxygen reading. Researchers now report a forensic framework designed to catch exactly this kind of stealthy attack by fusing two kinds of evidence that security tools usually examine in isolation: how a device transmits data, and what the data it transmits says about the patient.

The study, published in the Springer Nature journal Discover Networks, introduces the Multimodal Behavioral Fingerprinting Framework, or MBFF. Its lead author is Mussawir Ejaz, with co-authors Muhammad Zulkifl Hasan and Muhammad Zunnurain Hussain. The work is explicitly positioned as a post-incident investigative tool rather than a real-time firewall or intrusion detection system. The aim is forensic attribution: after an attack, an analyst working from captured traffic logs should be able to link malicious activity to a specific compromised device, even when conventional identifiers such as MAC or IP addresses have been spoofed.

The problem the authors target is what they call context blindness. Traditional digital forensics and intrusion detection systems rely largely on unimodal analysis of network traffic, focusing on packet headers and flow statistics. Such methods are effective against volumetric attacks like denial of service, where traffic behavior deviates sharply from the norm. But in a data alteration attack, a compromised sensor continues to obey standard protocols, so network-centric anomaly detection sees nothing unusual. The payload, however, may contain medically impossible values that could trigger incorrect automated treatments or false alarms. The framework’s designers argue that distinguishing a legitimate medical emergency from malicious data injection requires correlating the container of the data, meaning network behavior, with the content of the data, meaning biometric behavior.

MBFF works through a four-phase pipeline. First, traffic is passively captured from the IoMT gateway in read-only mode to preserve forensic integrity, and a dual-channel parser processes the raw capture files: one channel isolates TCP, UDP and IP headers to extract flow statistics, while the other performs deep packet inspection to decapsulate the application payload and extract physiological sensor readings. Crucially, this extraction is performed strictly offline, after a security event has occurred, not on the fly.

The second and third phases address a subtle technical challenge. Network features such as source bytes can range into the millions, while body temperature oscillates within a narrow band of roughly 36 to 40 degrees Celsius. Left unprocessed, the high-magnitude network features would dominate the machine learning objective function and render the biometric data statistically insignificant. The researchers therefore apply min-max normalization, scaling every feature into a bounded range between 0 and 1, so that a variation in body temperature carries equal statistical weight to a variation in network load. The normalized network vector and biometric vector are then fused through what the authors term Early Orthogonal Feature Fusion, a direct concatenation of the two feature sets into a single composite fingerprint. Because the parser extracts the two data streams asynchronously, the fusion engine indexes each vector by session identifier and timestamp and performs an exact-match join; any network flow lacking a corresponding biometric payload is excluded to prevent null values.

The choice of early fusion over late fusion, in which separate models vote on a final decision, is deliberate. The authors argue that late fusion risks losing granular cross-domain context before the final decision is rendered, whereas direct concatenation preserves the raw variance of both domains and lets a Random Forest classifier discover non-linear relationships between them. Their correlation analysis supports this design: the network and biometric features proved essentially statistically independent, with, for example, a correlation of only about 0.01 between temperature and source jitter. This orthogonality means the two feature sets carry non-redundant information, so fusing them maximizes information gain and allows the model to detect a data alteration attack, where biometrics change but the network does not, without being confused by network noise.

The framework was validated on the WUSTL-EHMS-2020 dataset, a realistic IoMT testbed containing 16,318 flow instances, each defined by 45 features spanning eight network features and three biometric features such as heart rate, blood pressure and temperature. The dataset is heavily imbalanced, mirroring real healthcare conditions: normal traffic accounts for 87.5 percent of instances, or 14,272 samples, while spoofing attacks make up 6.9 percent, or 1,124 samples, and data alteration attacks just 5.6 percent, or 922 samples. The statistical analysis confirmed why volumetric detection fails here: the mean source load for data alteration traffic was 18,359, far below the mean of 223,851 for normal traffic, showing these attacks do not stress network bandwidth.

To evaluate performance rigorously under this imbalance, the team used ten-fold stratified cross-validation and applied the Synthetic Minority Over-sampling Technique, SMOTE, exclusively to the training partitions of each fold, leaving validation folds unaltered to reflect real-world conditions. The multimodal model achieved an overall accuracy of 93.11 percent, with 93 percent precision and perfect recall for the normal class. Most significantly, it attained a near-perfect F1-score of 0.99 for detecting data alteration attacks, correctly identifying 185 of 187 such attempts. The confusion matrix showed strong diagonal dominance for the normal and data alteration classes, while the spoofing class showed low recall, roughly 0.05 to 0.07, because high-quality emulation tools can generate network traffic statistically indistinguishable from legitimate sensor behavior. The authors note that in healthcare the primary safety threat is not a device’s identity but the integrity of the data it reports, which is precisely where the multimodal approach excels.

Compared against a unimodal baseline framework built on network flow metrics alone, the picture is nuanced. The baseline achieved higher overall accuracy, 98.0 percent versus 93.11 percent, but it was evaluated on the IoT-23 dataset, dominated by noisy, high-volume attacks that are easy to distinguish from headers alone. On semantic data alteration attacks, the baseline methodology was, in the authors’ assessment, theoretically incapable of detection, with an effective F1-score of zero, while the proposed framework reached 99 percent. The team also reports a false positive rate of just 0.01 for the normal class, which they argue matters because high false positive rates in healthcare lead to alarm fatigue.

The authors acknowledge an important limitation: MBFF relies on unencrypted payloads, since deep packet inspection is hindered in environments enforcing strict end-to-end encryption such as TLS 1.3. While many legacy and resource-constrained medical sensors still transmit telemetry in plaintext before reaching a secure edge gateway, the trend toward ubiquitous encryption limits generalizability. Future work will explore encrypted traffic analysis techniques, including TLS behavioral fingerprinting and side-channel methods that infer payload states from packet size sequences and timing bursts. Within its scope, however, the study’s conclusion is firm: integrating physiological context into digital forensics is not merely an enhancement but a necessity for patient safety, giving investigators the evidence needed to distinguish technical malfunctions from malicious interventions in critical healthcare infrastructure.

Subject of Research: A multimodal forensic framework that fuses network traffic metrics with biometric payload data to attribute attacks on Internet of Medical Things devices.

Article Title: Multimodal behavioral fingerprinting of IoMT devices a forensic approach using network and biometric signatures

Article References: Ejaz, M., Hasan, M. Z., & Hussain, M. Z. (2026). Multimodal behavioral fingerprinting of IoMT devices a forensic approach using network and biometric signatures. Discover Networks, 2(1), Article 29. https://doi.org/10.1007/s44354-026-00042-1

Image Credits: AI Generated

DOI: 10.1007/s44354-026-00042-1

Keywords: Internet of Medical Things, digital forensics, behavioral fingerprinting, data alteration attacks, intrusion detection, WUSTL-EHMS-2020, machine learning, class imbalance, SMOTE, patient safety, network security, biometric telemetry