MVIIC: A Lightweight Modified GRU Framework for Multi-Vector DDoS Detection in IoMT Healthcare Systems

The rapid growth of Internet of Medical Things (IoMT) devices has improved healthcare delivery but also created new cybersecurity risks, especially from advanced multi-vector DDoS attacks that target devices with limited resources. Many existing intrusion detection systems either consume excessive computing power or cannot keep pace with evolving attack methods, making them impractical for real-time healthcare applications. In this study, we present the Multi-Vector IoT Intrusion Classifier (MVIIC), a lightweight framework that leverages Modified Gated Recurrent Units (MGRUs) and a genetic algorithm-based feature selection approach to efficiently detect multi-vector DDoS attacks. MVIIC includes two classifiers: a Binary Label Classifier (BLC) that gives simple threat alerts for non-technical healthcare staff, and a Multi-Label Classifier (MLC) that provides detailed attack information for cybersecurity experts. The MGRU design reduces computational complexity by 33% compared to a standard GRU while maintaining high detection accuracy by removing the reset gate. Tests on the CICIoT2023 and CICIoMT2024 datasets show strong results: the MLC reaches 99.92% accuracy, precision, recall, and F1-score on CICIoMT2024, which is 0.42% better than leading methods. The BLC achieves 99.96% accuracy with a 0.04% false-positive rate, making it well-suited for urgent healthcare settings. Using genetic algorithms to select features cuts feature size by 46-52% without losing detection quality. The lightweight design of the MGRU layers makes the architecture efficient and suitable for real-time deployment in resource-limited IoMT environments.