Dynamic-kernel CNN-LSTM for real-time intrusion detection in low-power healthcare IoT systems

Cybersecurity has become a serious concern in healthcare Internet of Things (IoT) systems, where connected medical devices support patient monitoring, diagnosis, and treatment but remain vulnerable to attacks. This paper presents a Dynamic-kernel Convolutional Neural Network--Long Short-Term Memory (DyK-CNN-LSTM) architecture for energy-efficient intrusion detection in healthcare IoT environments. The model combines SoftMax-gated dynamic convolutional kernels with bidirectional LSTM layers to learn multi-scale spatial dependencies and temporal correlations in network traffic. Causal pooling is incorporated to support low-latency, simulation-based real-time inference on low-power devices. Experiments on the IoT Healthcare Security and CICIoMT-2024 datasets produced an integrated-dataset accuracy of 98.42%, precision of 98.35%, recall of 98.41%, F1-score of 98.38%, and false alarm rate of 1.58%. Attack-specific analysis showed consistently strong detection across DDoS, replay, ransomware, brute-force, data-exfiltration, botnet, scanning, and backdoor attacks. Hardware-aware simulation on a 100 MHz ARM Cortex--M4 target indicated an energy consumption of 92.3 µJ and a latency of 24.5 ms per inference, with real hardware validation planned as future work. The proposed DyK-CNN-LSTM framework therefore offers a balanced design for accurate, scalable, and energy-aware intrusion detection in medical IoT systems.