Impact of Input Sequence Types on Healthcare Intrusion Prediction Models

Abstract

Prediction models are vital for sensing zero-day and even n-day cyberattacks, particularly in healthcare infrastructure. Most existing research focuses on developing classifiers also known as IDS to enhance detection and accuracy. However, predictive intrusion models for healthcare remain underexplored, with limited studies investigating the comparative performance of univariate and multivariate inputs against single-step and multi-step outputs in time series models. This study aims to address these gaps by evaluating the accuracy and error performance of selected predictive models across various input and output configurations. The methodology involves transforming input data sequences into univariate l* n and multivariate m * n formats, establishing single-step and multi-step splitting functions, and evaluating these configurations using the benchmark CIRA-CIC-DoHBrw-2020 dataset. Algorithms including Bidirectional LSTM, Stacked LSTM, Vanilla LSTM, Transformer Encoder-Decoder, Vector Output LSTM (GRU core), and CNN were applied, with results visualized to assess performance. The findings reveal that the Multivariate LSTM model, when trained on a sequence of multivariate inputs, demonstrates superior predictive performance, achieving low MAE error rates of 0.4% for single-step predictions and 0.1% for multi-step predictions. Additionally, GRU and Transformer models exhibit heightened sensitivity to specific input sequence configurations. In conclusion, our study demonstrates that Transformer Encoder-Decoder based prediction models exhibit exceptional prediction performance. This effectiveness is attributed to their ability to capture contextual and critical information from input sequences. These findings provide valuable insights for designing advanced intrusion prediction models, paving the way for improved prediction capabilities in future systems.