AN EMPIRICAL ANALYSIS OF ANOMALY DETECTION MODEL PARADIGMS UNDER HETEROGENEOUS IOMT ATTACK TRAFFIC

Background: Hospitals increasingly rely on heterogeneous Internet of Medical Things (IoMT) devices, which generate highly diverse network traffic.This discrepancy between traffic heterogeneity and joint anomaly modeling is an important question regarding how different anomaly detection paradigms understand abnormal behavior. Methods: This paper describes an empirical study of three unsupervised anomaly detection model paradigms Isolation Forest (treebased), One-Class Support Vector Machine (boundary-based), and Local Outlier Factor (density-based) using the CICIoMT2024 dataset, which contains traffic from multiple IoMT devices. We synthetically engineer malicious network flow scenarios from this dataset to evaluate how each model responds to anomalous behavior when exposed to the same attack inputs. Results: Rather than focusing entirely on binary detection outcomes this study emphasizes differences in anomaly score behavior and detection sensitivity across different models. The results highlight that model responses vary significantly depending on how abnormality is defined.