Autonomous and Context-Adaptive Defense Mechanisms for Identity Access Management in Internet of Medical Things

Identity and Access Management (IAM) in the Internet of Medical Things (IoMT) faces critical challenges, including the detection of sophisticated attack patterns and the execution of real-time threat responses. This work presents the IoMT Sentinel Platform, an adaptive security framework designed for IoMT environments. The platform integrates a finetuned DistilBERT model for anomaly detection in contextualized IAM and system logs, achieving an accuracy of 99.98 % on a simulated IoMT dataset. Beyond detection, the platform introduces a dynamic trust scoring engine that evaluates each device's security posture based on access history, network behavior, and anomaly records. This trust score directly influences an automated response engine that leverages Keycloak APIs to revoke tokens, adjust privileges, and block malicious IP addresses in real time. Experimental evaluations across multiple scenarios demonstrate the system's ability to detect volumetric and distributed attacks, enforce dynamic trust-based policies, and adaptively mitigate threats with low response latency. This work is among the first to integrate a lightweight language model, a dynamic trust scoring engine, and an autonomous IAM mitigation system into a unified IoMT security framework. Unlike previous approaches that focus solely on detection, the proposed platform emphasizes real-time defense through seamless coupling of anomaly detection and IAM policy enforcement. Our results demonstrate that such a synergy enables proactive and scalable protection in medical IoT environments.