Per-Device Behavioral Anomaly Detection in IoMT Networks Using Autoencoders and EVT-Based Adaptive Thresholds - Limeira, Evelin E. D.; Roque, Rafael; Cabral, Luciano; Aires, Fernando; Santos, Wellison R. M.; Lima, Milton (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais do XXVI Simpósio Brasileiro de Cibersegurança, 2026)
Intrusion Detection Systems (IDSs) for the Internet of Medical Things (IoMT) must handle highly heterogeneous device traffic, which directly impacts anomaly detection and false-positive rates. This study evaluates per-device benign-only autoencoders combined with Extreme Value Theory (EVT)-based adaptive thresholds, localized reconstruction errors scoring, and SHAP-based feature attribution. Experiments are conducted on offline traffic traces from camera-class devices in the CICIoMT2024 dataset, considering behavioral, MQTT-based, and volumetric attack groups. Results indicate that per-device modeling is more effective at characterizing behavioral deviations than volumetric flooding attacks in this scenario. Furthermore, localized reconstruction-error scoring provides a more sensitive operating point than conventional global thresholding strategies.