Spatial–temporal graph neural network with autoencoder pretraining for intrusion detection in healthcare IoT ecosystems

The integration of Internet of Things (IoT) technologies in healthcare has enabled continuous patient monitoring and intelligent clinical decision-making but has also exposed critical infrastructures to sophisticated cyber threats. Traditional intrusion detection systems, including classical machine learning and conventional deep learning methods, often fail to capture the complex spatial dependencies among interconnected devices and the temporal dynamics of evolving attacks, particularly under class imbalance and rare intrusion categories. To address these challenges, this paper proposes a novel Spatial-Temporal Graph Neural Network with Autoencoder Pretraining (ST-GNN+AE) for intrusion detection in healthcare IoT ecosystems. The framework leverages autoencoder-based unsupervised pretraining to enhance feature representations, followed by a spatial-temporal GNN that jointly models device-level interactions and sequential traffic patterns. Experimental results on the IoT Healthcare dataset show that the proposed model achieves [Formula: see text] accuracy, 0.983 F1-score, and 0.992 ROC-AUC in binary classification, while reaching a Macro-F1 of 0.941 in multiclass detection. In cross-domain evaluation, when trained on the IoT Healthcare dataset and tested on the TON-IoT dataset, the model maintains strong generalization with [Formula: see text] accuracy, 0.942 F1-score, and 0.959 ROC-AUC. These findings highlight the potential of the proposed approach to provide secure, reliable, and adaptable intrusion detection for next-generation healthcare IoT infrastructures.