The increasing prevalence of ransomware and cyberattacks in the healthcare sector poses a serious threat to patient safety, data integrity, and the operational continuity of medical services. The rapid expansion of Internet-of-Medical-Things (IoMT) devices, often constrained by limited resources, heterogeneous architectures, and weak security configurations, has further enlarged the cyberattack surface and intensified the need for robust intrusion detection mechanisms. This work presents a data-driven evaluation of machine learning and ensemble-based frameworks for detecting ransomware incidents and IoMT-targeted intrusions in healthcare networks. Two real-world benchmark datasets, the Healthcare Ransomware Incident Dataset and the WUSTL-EHMS-2020 dataset, are employed to design six experimental test cases spanning baseline classifiers (Decision Tree, Random Forest, and XGBoost) and advanced ensemble architectures (stacking, stacking with XGBoost, and a hybrid voting ensemble). To address class imbalance, the Synthetic Minority Oversampling Technique (SMOTE) is integrated into all model configurations. Performance is assessed using accuracy, precision, recall, and F1-score. The results demonstrate consistent performance gains across successive model architectures, with the hybrid voting ensemble achieving 99.9% accuracy for IoMT intrusion detection and 97.4% for ransomware identification while maintaining low false-positive and false-negative rates. These findings indicate that SMOTE-enhanced ensemble learning provides a practical balance between predictive accuracy, computational efficiency, and interpretability. The proposed framework offers a reproducible and deployment-oriented approach for strengthening cybersecurity resilience against ransomware and IoMT-based attacks in healthcare environments.
Zayed et al. (2026) studied this question.