A Systematic Review of Intrusion Detection Systems for Internet of Medical Things: Performance, Efficiency, Explainability, and Generalization

The Internet of Medical Things (IoMT) has transformed healthcare delivery through medical devices, remote patient monitoring, and real-time clinical decision support. However, the proliferation of IoMT devices introduces security vulnerabilities that put patient safety and data privacy at risk. Intrusion Detection Systems (IDS) have emerged as essential components for protecting IoMT networks from cyberattacks. This article presents a systematic review of IoMT-IDS research, analyzing 53 high-quality papers published between 2020 and 2025, identified through database searches spanning 2016–2025 across IEEE Xplore, Springer, ScienceDirect, and ACM Digital Library. We organize the literature through a comprehensive taxonomy spanning classical machine learning approaches, deep learning architectures, transformer-based models, federated learning frameworks, and anomaly detection techniques. Our analysis reveals significant diversity across detection approaches and impressive within-dataset performance achievements, yet identifies persistent gaps in evaluation practices. While detection performance is consistently reported across studies, four other evaluation dimensions remain unaddressed: computational efficiency profiling, explainability integration, standardized benchmarking practices, and cross-dataset generalization assessment. We synthesize the literature into these five evaluation dimensions as a foundation for comprehensive IoMT-IDS assessment. We then analyze state-of-the-art approaches, highlight tradeoffs between competing requirements, and chart future research directions toward unified evaluation methodologies that support deployment in safety-critical healthcare environments.