A hybrid blockchain based deep learning model for multivector attack detection in internet of things enabled healthcare systems

Why protecting connected hospitals matters

Modern hospitals increasingly rely on internet-connected devices: heart monitors that stream vital signs, infusion pumps that adjust drug doses, and wearable sensors that follow patients home. This digital web can greatly improve care—but it also opens new doors for hackers. The paper explains a new way to guard these medical networks against a mix of cyberattacks, using a combination of artificial intelligence and blockchain, with the aim of spotting threats in milliseconds while keeping patient data trustworthy and private.

Many doors, many kinds of intruders

Healthcare networks are unlike ordinary office systems. They mix old and new equipment, must respond in real time, and carry highly sensitive information. Attackers can flood networks to shut down services, secretly intercept messages, guess passwords through repeated logins, or slowly move across layers of the system from a single weak device. The authors describe how these “multi‑vector” attacks can strike devices, data, infrastructure, and even life‑critical equipment such as ventilators, making it clear that simple firewalls and rule lists are no longer enough.

Teaching machines to recognize bad behavior

The proposed approach uses deep learning to watch network traffic and decide whether it looks normal or malicious. First, a model called a deep sparse autoencoder compresses the many technical details of each network flow—who talks to whom, how often, and how much data—into a short fingerprint that still preserves the important patterns. These fingerprints feed a bidirectional recurrent network that learns how traffic evolves over time, so it can tell the difference between a short burst of activity and the slow buildup of an attack. In parallel, three specialist detectors focus on particular threats: one tuned for denial‑of‑service floods, one for man‑in‑the‑middle tampering, and one for brute‑force logins.

Combining expert opinions and judging confidence

Rather than let a single model decide, the system blends the outputs of all detectors using a Bayesian “product‑of‑experts” fusion step. This mathematically rewards agreement between experts and down‑weights unreliable signals. A calibration stage then adjusts these probabilities so that, for example, a 90% alarm really behaves like “9 in 10” in practice. The system also considers the medical context: for a life‑support device, it leans toward caution, treating suspicious behavior more seriously than it would for a less critical sensor. When confidence is high, the system can trigger blocking or rerouting; when uncertainty is high, it can flag traffic for human review instead of acting automatically.

Writing an unchangeable security diary

To track what happens across different hospitals or clinics, the authors add a private blockchain layer. Every detection event—what was seen, how sure the system was, and what response was taken—is written into a shared ledger using a fast consensus method, so no single party can secretly edit the record. Smart contracts on this ledger enforce who is allowed to see which parts of the logs, depending on their role and purpose, while keeping delays low enough that ongoing care is not disrupted. Tests on a simulated 12‑node healthcare network show that the blockchain can process hundreds of security events per second with high success rates and sub‑second confirmation times.

How well it works in practice

The team evaluated their design on two large collections of real and simulated Internet‑of‑Things traffic, one tailored to intensive‑care devices and another spanning more than a hundred different gadgets. Across these datasets, the combined system detected attacks with about 93–97% accuracy, outperforming traditional methods such as signature‑based tools, support vector machines, and random forests by 7–20 percentage points. Crucially, it did so with detection delays under 16 milliseconds in controlled tests, and it handled multiple attack types at once better than any single model alone. When models trained on one dataset were tested on the other, performance dropped but remained respectable, suggesting a moderate ability to generalize beyond the training environment.

What this means for patients and hospitals

In simple terms, the study shows that hospitals can use a blend of advanced pattern‑recognition and tamper‑proof logging to watch over their connected devices in real time. The deep‑learning components act like a team of security analysts that specialize in different kinds of misbehavior, while the blockchain acts as an incorruptible notebook of what was detected and how staff responded. Although the authors note that real‑world trials and better handling of rare, sophisticated attacks are still needed, their results suggest that such a hybrid design could make future digital hospitals both smarter and safer, reducing the chances that a cyberattack silently alters data or disrupts care.

Citation: Sengan, S., Shieh, CS. & Horng, MF. A hybrid blockchain based deep learning model for multivector attack detection in internet of things enabled healthcare systems. Sci Rep 16, 10060 (2026). https://doi.org/10.1038/s41598-026-40765-3

Keywords: healthcare cybersecurity, internet of things, blockchain security, intrusion detection, deep learning