A Blockchain-Enabled Severity-Aware Framework for Ransomware Resilience in Healthcare IoT

The growing adoption of Healthcare Internet of Things (HIoT) systems has improved patient monitoring and clinical efficiency. Still, it has ‎also exposed hospitals to ransomware attacks that can disrupt life-critical operations. Conventional intrusion detection systems (IDS) such ‎as Snort, Suricata, and Kitsune struggle to provide tamper-proof evidence or prioritize device-specific risks, limiting their effectiveness in ‎clinical environments. To address this gap, we propose a blockchain-assisted framework that integrates hybrid anomaly detection, Byzantine ‎fault-tolerant forensic logging, and severity-aware mitigation. Suspicious traffic is first evaluated using anomaly scoring with EVT-based ‎thresholding, then immutably recorded on a blockchain ledger via PBFT consensus, ensuring tamper-resistance. Smart contracts enforce ‎mitigation decisions based on severity scores that account for anomaly magnitude, device criticality, and network exposure, thereby guaran-‎teeing the rapid protection of life-support devices while minimizing unnecessary disruption to low-risk equipment. An experimental evalua-‎tion of the N-BaIoT, ToN_IoT, and CIC-IDS2017 datasets shows that the framework achieves a detection accuracy of up to 98%, a false-‎positive rate of 1.1%, and an average latency of 6.8 ms, outperforming baseline IDS solutions. Security analyses confirm resilience against ‎log tampering, obfuscation-based evasion, and denial-of-service flooding, while throughput scalability exceeded 2200 TPS across hospital ‎nodes. By combining blockchain accountability with clinically aware mitigation, this framework provides a robust, real-time defense against ‎ransomware in HIoT environments, advancing the state of cybersecurity for patient-centered healthcare systems‎.