{"id":"https://openalex.org/W7225330711","doi":"https://doi.org/10.1038/s41598-026-74494-4","title":"A generative adversarial network-augmented dual-stream Mamba-transformer framework for advanced intrusion detection and cyber threat mitigation in smart healthcare networks","display_name":"A generative adversarial network-augmented dual-stream Mamba-transformer framework for advanced intrusion detection and cyber threat mitigation in smart healthcare networks","publication_year":2026,"publication_date":"2026-11-05","ids":{"openalex":"https://openalex.org/W7225330711","doi":"https://doi.org/10.1038/s41598-026-74494-4"},"language":"en","primary_location":{"id":"doi:10.1038/s41598-026-74494-4","doi":"https://doi.org/10.1038/s41598-026-74494-4","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-74494-4","pdf_url":"https://www.nature.com/articles/s41598-026-74494-4.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.nature.com/articles/s41598-026-74494-4.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019636730","display_name":"Purushottam Kumar","orcid":"https://orcid.org/0009-0004-1263-9888","observed_orcids":["https://orcid.org/0009-0004-1263-9888","https://orcid.org/0000-0001-9811-9234"]},"institutions":[{"id":"https://openalex.org/I115715567","display_name":"Birla Institute of Technology, Mesra","ror":"https://ror.org/028vtqb15","country_code":"IN","type":"education","lineage":["https://openalex.org/I115715567"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Purushottam Kumar","raw_affiliation_strings":["Birla Institute of Technology, Mesra (BIT Mesra), Ranchi, Jharkhand, 835215, India"],"raw_orcid":"https://orcid.org/0009-0004-1263-9888","affiliations":[{"raw_affiliation_string":"Birla Institute of Technology, Mesra (BIT Mesra), Ranchi, Jharkhand, 835215, India","institution_ids":["https://openalex.org/I115715567"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101858276","display_name":"Sanjay Kumar","orcid":"https://orcid.org/0009-0009-7752-5466","observed_orcids":["https://orcid.org/0009-0009-7752-5466"]},"institutions":[{"id":"https://openalex.org/I115715567","display_name":"Birla Institute of Technology, Mesra","ror":"https://ror.org/028vtqb15","country_code":"IN","type":"education","lineage":["https://openalex.org/I115715567"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Sanjay Kumar","raw_affiliation_strings":["Birla Institute of Technology, Mesra (BIT Mesra), Ranchi, Jharkhand, 835215, India"],"raw_orcid":"https://orcid.org/0009-0009-7752-5466","affiliations":[{"raw_affiliation_string":"Birla Institute of Technology, Mesra (BIT Mesra), Ranchi, Jharkhand, 835215, India","institution_ids":["https://openalex.org/I115715567"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042086439","display_name":"Indrajit Mukherjee","orcid":"https://orcid.org/0000-0002-8986-4299","observed_orcids":["https://orcid.org/0000-0002-8986-4299","https://orcid.org/0000-0001-8839-9981"]},"institutions":[{"id":"https://openalex.org/I115715567","display_name":"Birla Institute of Technology, Mesra","ror":"https://ror.org/028vtqb15","country_code":"IN","type":"education","lineage":["https://openalex.org/I115715567"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Indrajit Mukherjee","raw_affiliation_strings":["Birla Institute of Technology, Mesra (BIT Mesra), Ranchi, Jharkhand, 835215, India"],"raw_orcid":"https://orcid.org/0000-0001-8839-9981","affiliations":[{"raw_affiliation_string":"Birla Institute of Technology, Mesra (BIT Mesra), Ranchi, Jharkhand, 835215, India","institution_ids":["https://openalex.org/I115715567"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5019636730","https://openalex.org/A5042086439","https://openalex.org/A5101858276"],"corresponding_institution_ids":["https://openalex.org/I115715567"],"apc_list":{"value":2690,"currency":"USD","value_usd":2690},"apc_paid":{"value":2690,"currency":"USD","value_usd":2690},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"16","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9970999956130981,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0006000000284984708,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.9750000238418579},{"id":"https://openalex.org/keywords/internet-of-medical-things","display_name":"Internet of Medical Things","score":0.9200000166893005},{"id":"https://openalex.org/keywords/mamba","display_name":"Mamba","score":0.5389999747276306},{"id":"https://openalex.org/keywords/state-space-models","display_name":"state-space model","score":0.7110000252723694},{"id":"https://openalex.org/keywords/transformer","display_name":"transformer models","score":0.5799999833106995},{"id":"https://openalex.org/keywords/generative-adversarial-networks","display_name":"generative adversarial networks","score":0.7770000100135803},{"id":"https://openalex.org/keywords/ctgan","display_name":"CTGAN","score":0.5550000071525574},{"id":"https://openalex.org/keywords/data-augmentation","display_name":"data augmentation","score":0.8410000205039978},{"id":"https://openalex.org/keywords/class-imbalance","display_name":"class imbalance","score":0.9860000014305115},{"id":"https://openalex.org/keywords/dual-stream-encoder","display_name":"dual-stream encoder","score":0.6150000095367432},{"id":"https://openalex.org/keywords/cyber-threat-mitigation","display_name":"cyber threat mitigation","score":0.7549999952316284},{"id":"https://openalex.org/keywords/ddos-attacks","display_name":"DDoS attacks","score":0.8090000152587891},{"id":"https://openalex.org/keywords/ransomware","display_name":"ransomware","score":0.906000018119812},{"id":"https://openalex.org/keywords/ciciomt2024","display_name":"CICIoMT2024","score":0.8790000081062317}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8335999846458435},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.5817000269889832},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5551000237464905},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.5376999974250793},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5375000238418579},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.5270000100135803},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.4869999885559082},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.43140000104904175},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.42080000042915344},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.4081999957561493},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.39410001039505005},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.3831999897956848},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.35429999232292175},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3467999994754791},{"id":"https://openalex.org/C2775896111","wikidata":"https://www.wikidata.org/wiki/Q642560","display_name":"Router","level":2,"score":0.34610000252723694},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.3334999978542328},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.3228999972343445},{"id":"https://openalex.org/C35341882","wikidata":"https://www.wikidata.org/wiki/Q8795","display_name":"Internet Protocol","level":3,"score":0.31940001249313354},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.31679999828338623},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.31139999628067017},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.26989999413490295},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26080000400543213},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.26030001044273376},{"id":"https://openalex.org/C160735492","wikidata":"https://www.wikidata.org/wiki/Q31207","display_name":"Health care","level":2,"score":0.25780001282691956},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.25459998846054077},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2542000114917755}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1038/s41598-026-74494-4","doi":"https://doi.org/10.1038/s41598-026-74494-4","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-74494-4","pdf_url":"https://www.nature.com/articles/s41598-026-74494-4.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:d0ae0ecb3b9b485c993c6bac1b2c97eb","doi":null,"is_oa":false,"landing_page_url":"https://doaj.org/article/d0ae0ecb3b9b485c993c6bac1b2c97eb","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Scientific Reports, Vol 16, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1038/s41598-026-74494-4","doi":"https://doi.org/10.1038/s41598-026-74494-4","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41598-026-74494-4","pdf_url":"https://www.nature.com/articles/s41598-026-74494-4.pdf","source":{"id":"https://openalex.org/S196734849","display_name":"Scientific Reports","issn_l":"2045-2322","issn":["2045-2322"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","dongbi-c","doyens","jufo-1","ki-jl-1","medline","norway-1","poland-140","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Scientific Reports","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/3","display_name":"Good health and well-being","score":0.4043000042438507}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225330711.pdf","grobid_xml":"https://content.openalex.org/works/W7225330711.grobid-xml"},"referenced_works_count":22,"referenced_works":["https://openalex.org/W2296509296","https://openalex.org/W2793022090","https://openalex.org/W3033120446","https://openalex.org/W3159885303","https://openalex.org/W3213173707","https://openalex.org/W3216173637","https://openalex.org/W4226319939","https://openalex.org/W4226429785","https://openalex.org/W4382281941","https://openalex.org/W4392158962","https://openalex.org/W4402035331","https://openalex.org/W4403685098","https://openalex.org/W4404118847","https://openalex.org/W4406710186","https://openalex.org/W4410379710","https://openalex.org/W4413404027","https://openalex.org/W4416222827","https://openalex.org/W4416389952","https://openalex.org/W4417519859","https://openalex.org/W7114788916","https://openalex.org/W7127591575","https://openalex.org/W7131905588"],"related_works":["https://openalex.org/W7125961173","https://openalex.org/W7224134018","https://openalex.org/W7214107518","https://openalex.org/W7164540235","https://openalex.org/W7166313207","https://openalex.org/W4415305030","https://openalex.org/W4415774225","https://openalex.org/W4413003778","https://openalex.org/W7172521674","https://openalex.org/W7171854083"],"abstract_inverted_index":{"The":[0,141],"rapid":[1],"proliferation":[2],"of":[3,6,16],"the":[4,13,154,179],"Internet":[5],"Medical":[7],"Things":[8],"(IoMT)":[9],"has":[10],"dramatically":[11],"expanded":[12],"attack":[14,125,181],"surface":[15],"smart":[17,72],"healthcare":[18,73],"networks,":[19],"with":[20,217],"cyber-threats":[21],"including":[22,162],"DDoS,":[23],"spoofing,":[24],"reconnaissance,":[25],"and":[26,31,48,109,116,150,167,209],"ransomware":[27],"targeting":[28],"IoMT":[29,54,215],"infrastructures":[30],"jeopardizing":[32],"patient":[33],"safety.":[34],"Traditional":[35],"intrusion":[36,63],"detection":[37,64,70],"systems":[38],"(IDS)":[39],"fail":[40],"to":[41,176],"address":[42],"protocol":[43,93],"heterogeneity,":[44],"high-dimensional":[45],"traffic":[46,87],"data,":[47],"severe":[49],"class":[50,126],"imbalance":[51],"inherent":[52],"in":[53,71,132],"environments.":[55],"This":[56],"paper":[57],"proposes":[58],"GAN-Mamba":[59,203],"Former-IDS,":[60],"a":[61,81,96,105,206],"novel":[62],"framework":[65,143],"for":[66,178,213],"advanced":[67],"cyber":[68],"threat":[69],"networks.":[74],"Three":[75],"core":[76],"innovations":[77],"are":[78,184],"integrated:":[79],"(i)":[80],"Protocol-Aware":[82],"Feature":[83],"Router":[84],"partitioning":[85],"network":[86],"features":[88],"into":[89],"four":[90],"semantically":[91],"coherent":[92],"groups;":[94],"(ii)":[95],"dual-stream":[97],"Mamba-Transformer":[98],"encoder":[99],"concurrently":[100],"capturing":[101],"sequential":[102],"dependencies":[103],"via":[104,113],"linear-time":[106],"state-space":[107],"model":[108],"global":[110],"feature":[111],"interactions":[112],"multi-head":[114],"self-attention;":[115],"(iii)":[117],"Conditional":[118],"Tabular":[119],"GAN":[120],"(CTGAN)-based":[121],"augmentation":[122,170],"addressing":[123],"minority":[124],"imbalance.":[127],"All":[128],"experiments":[129],"were":[130],"implemented":[131],"PyTorch":[133],"2.1":[134],"on":[135,153],"an":[136],"NVIDIA":[137],"A100":[138],"40GB":[139],"GPU.":[140],"proposed":[142],"achieves":[144],"97.71%":[145],"accuracy,":[146],"0.7901":[147,200],"macro-F1":[148,173],"score,":[149],"0.9842":[151],"ROC-AUC":[152],"19-class":[155],"CICIoMT2024":[156],"test":[157],"set,":[158],"outperforming":[159],"baseline":[160],"models":[161],"MLP,":[163],"1D-CNN,":[164],"BiLSTM,":[165],"Transformer-only,":[166],"Mamba-only.":[168],"CTGAN":[169],"improves":[171],"minority-class":[172],"by":[174],"up":[175],"+0.2109":[177],"rarest":[180],"classes.":[182],"Results":[183],"confirmed":[185],"across":[186,220],"five":[187,221],"random":[188],"seeds":[189],"(mean":[190],"\u00b1":[191,196,201],"std:":[192],"Accuracy":[193],"=":[194,199],"97.71":[195],"0.38%,":[197],"Macro-F1":[198],"0.014).":[202],"Former-IDS":[204],"provides":[205],"scalable,":[207],"reproducible,":[208],"effective":[210],"cybersecurity":[211],"solution":[212],"next-generation":[214],"environments,":[216],"demonstrated":[218],"generalization":[219],"heterogeneous":[222],"IoT":[223],"security":[224],"benchmarks.":[225]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-06T00:00:00"}