Towards Zero-Trust Security in Healthcare: GCN-Driven DDoS Detection in an Edge-Cloud Architecture

Morgana Mo Zhou; Yucheng Liu; Zhifu Zhang; Hao Liu; Jia Zhou; Gerhard P. Hancke

doi:10.1109/ICC59461.2026.11587522

Towards Zero-Trust Security in Healthcare: GCN-Driven DDoS Detection in an Edge-Cloud Architecture

Morgana Mo Zhou
, Yucheng Liu^*
, Zhifu Zhang
, Hao Liu
, Jia Zhou
, Gerhard P. Hancke^*

^*Corresponding author for this work

Department of Computer Science

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

Abstract

The Internet of Medical Things (IoMT) enables continuous patient monitoring but remains highly vulnerable to distributed denial-of-service (DDoS) attacks that can disrupt critical healthcare services. We propose a Zero-Trust framework that embeds anomaly detection directly into the enforcement loop using a semi-supervised Relational Graph Convolutional Network (R-GCN). IoMT traffic is modeled as temporal graphs that integrate network statistics with physiological signals, allowing the R-GCN to generate device-level risk scores for adaptive actions such as quarantine or re-authentication. The framework is implemented on a physical IoMT testbed comprising 25 devices, multiple gateways, and a cloud-hosted Policy Decision Point. Experiments show a True Positive Rate of 0.90 with a False Positive Rate of 0.07, containment of high-intensity DDoS attacks within 22 seconds, and maintenance of over 94% vital-sign delivery. These results demonstrate that graph-based anomaly detection enhances the resilience of IoMT infrastructures when tightly integrated with Zero-Trust principles. ©2026 IEEE

Original language	English
Title of host publication	ICC 2026 - IEEE International Conference on Communications Proceedings
Publisher	IEEE
Number of pages	6
ISBN (Electronic)	979-8-3195-4209-0
ISBN (Print)	979-8-3195-4210-6
DOIs	https://doi.org/10.1109/ICC59461.2026.11587522
Publication status	Published - 2026
Event	2026 IEEE International Conference on Communications (ICC 2026): Connected World for Sustainable Future - Glasgow, United Kingdom Duration: 24 May 2026 → 28 May 2026 https://icc2026.ieee-icc.org/

Conference

Conference	2026 IEEE International Conference on Communications (ICC 2026)
Abbreviated title	IEEE ICC 2026
Place	United Kingdom
City	Glasgow
Period	24/05/26 → 28/05/26
Internet address	https://icc2026.ieee-icc.org/

Bibliographical note

Information for this record is supplemented by the author(s) concerned.

Funding

This work was supported by the Research Grants Council of the Hong Kong Special Administrative Region, China, under Project CityU 11217125, and the PCL project (PCL2025A13).

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 9 Industry, Innovation, and Infrastructure

Research Keywords

zero-trust architecture
Internet of Medical Things (IoMT)
graph neural networks
anomaly detection
distributed denial-of-service (DDoS)

RGC Funding Information

RGC-funded

Access Output

10.1109/ICC59461.2026.11587522

Other Access Options

Check CityUHK Library

Permanent Link

Right click to copy link

Cite this

@inproceedings{0c7638b60b284fdeae6b1ef66b531461,

title = "Towards Zero-Trust Security in Healthcare: GCN-Driven DDoS Detection in an Edge-Cloud Architecture",

abstract = "The Internet of Medical Things (IoMT) enables continuous patient monitoring but remains highly vulnerable to distributed denial-of-service (DDoS) attacks that can disrupt critical healthcare services. We propose a Zero-Trust framework that embeds anomaly detection directly into the enforcement loop using a semi-supervised Relational Graph Convolutional Network (R-GCN). IoMT traffic is modeled as temporal graphs that integrate network statistics with physiological signals, allowing the R-GCN to generate device-level risk scores for adaptive actions such as quarantine or re-authentication. The framework is implemented on a physical IoMT testbed comprising 25 devices, multiple gateways, and a cloud-hosted Policy Decision Point. Experiments show a True Positive Rate of 0.90 with a False Positive Rate of 0.07, containment of high-intensity DDoS attacks within 22 seconds, and maintenance of over 94\% vital-sign delivery. These results demonstrate that graph-based anomaly detection enhances the resilience of IoMT infrastructures when tightly integrated with Zero-Trust principles. {\textcopyright}2026 IEEE",

keywords = "zero-trust architecture, Internet of Medical Things (IoMT), graph neural networks, anomaly detection, distributed denial-of-service (DDoS)",

author = "Zhou, \{Morgana Mo\} and Yucheng Liu and Zhifu Zhang and Hao Liu and Jia Zhou and Hancke, \{Gerhard P.\}",

note = "Information for this record is supplemented by the author(s) concerned. ; 2026 IEEE International Conference on Communications (ICC 2026) : Connected World for Sustainable Future, IEEE ICC 2026 ; Conference date: 24-05-2026 Through 28-05-2026",

year = "2026",

doi = "10.1109/ICC59461.2026.11587522",

language = "English",

isbn = "979-8-3195-4210-6",

booktitle = "ICC 2026 - IEEE International Conference on Communications Proceedings",

publisher = "IEEE",

address = "United States",

url = "https://icc2026.ieee-icc.org/",

}

Zhou, MM , Liu, Y , Zhang, Z , Liu, H, Zhou, J & Hancke, GP 2026, Towards Zero-Trust Security in Healthcare: GCN-Driven DDoS Detection in an Edge-Cloud Architecture. in ICC 2026 - IEEE International Conference on Communications Proceedings. IEEE, 2026 IEEE International Conference on Communications (ICC 2026), Glasgow, United Kingdom, 24/05/26. https://doi.org/10.1109/ICC59461.2026.11587522

Towards Zero-Trust Security in Healthcare: GCN-Driven DDoS Detection in an Edge-Cloud Architecture. / Zhou, Morgana Mo ; Liu, Yucheng ; Zhang, Zhifu et al.
ICC 2026 - IEEE International Conference on Communications Proceedings. IEEE, 2026.

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

TY - GEN

T1 - Towards Zero-Trust Security in Healthcare

T2 - 2026 IEEE International Conference on Communications (ICC 2026)

AU - Zhou, Morgana Mo

AU - Liu, Yucheng

AU - Zhang, Zhifu

AU - Liu, Hao

AU - Zhou, Jia

AU - Hancke, Gerhard P.

N1 - Information for this record is supplemented by the author(s) concerned.

PY - 2026

Y1 - 2026

N2 - The Internet of Medical Things (IoMT) enables continuous patient monitoring but remains highly vulnerable to distributed denial-of-service (DDoS) attacks that can disrupt critical healthcare services. We propose a Zero-Trust framework that embeds anomaly detection directly into the enforcement loop using a semi-supervised Relational Graph Convolutional Network (R-GCN). IoMT traffic is modeled as temporal graphs that integrate network statistics with physiological signals, allowing the R-GCN to generate device-level risk scores for adaptive actions such as quarantine or re-authentication. The framework is implemented on a physical IoMT testbed comprising 25 devices, multiple gateways, and a cloud-hosted Policy Decision Point. Experiments show a True Positive Rate of 0.90 with a False Positive Rate of 0.07, containment of high-intensity DDoS attacks within 22 seconds, and maintenance of over 94% vital-sign delivery. These results demonstrate that graph-based anomaly detection enhances the resilience of IoMT infrastructures when tightly integrated with Zero-Trust principles. ©2026 IEEE

AB - The Internet of Medical Things (IoMT) enables continuous patient monitoring but remains highly vulnerable to distributed denial-of-service (DDoS) attacks that can disrupt critical healthcare services. We propose a Zero-Trust framework that embeds anomaly detection directly into the enforcement loop using a semi-supervised Relational Graph Convolutional Network (R-GCN). IoMT traffic is modeled as temporal graphs that integrate network statistics with physiological signals, allowing the R-GCN to generate device-level risk scores for adaptive actions such as quarantine or re-authentication. The framework is implemented on a physical IoMT testbed comprising 25 devices, multiple gateways, and a cloud-hosted Policy Decision Point. Experiments show a True Positive Rate of 0.90 with a False Positive Rate of 0.07, containment of high-intensity DDoS attacks within 22 seconds, and maintenance of over 94% vital-sign delivery. These results demonstrate that graph-based anomaly detection enhances the resilience of IoMT infrastructures when tightly integrated with Zero-Trust principles. ©2026 IEEE

KW - zero-trust architecture

KW - Internet of Medical Things (IoMT)

KW - graph neural networks

KW - anomaly detection

KW - distributed denial-of-service (DDoS)

UR - https://www.scopus.com/pages/publications/105045338314

UR - https://www.scopus.com/pages/publications/105045338314#tab=impact

U2 - 10.1109/ICC59461.2026.11587522

DO - 10.1109/ICC59461.2026.11587522

M3 - RGC 32 - Refereed conference paper (with host publication)

SN - 979-8-3195-4210-6

BT - ICC 2026 - IEEE International Conference on Communications Proceedings

PB - IEEE

Y2 - 24 May 2026 through 28 May 2026

ER -

Towards Zero-Trust Security in Healthcare: GCN-Driven DDoS Detection in an Edge-Cloud Architecture

Abstract

Conference

Bibliographical note

Funding

UN SDGs

Research Keywords

RGC Funding Information

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

GRF: Detecting Non-Line-of-Sight Channel Spoofing in Time-of-Flight Ranging

Cite this

Towards Zero-Trust Security in Healthcare: GCN-Driven DDoS Detection in an Edge-Cloud Architecture

Abstract

Conference

Bibliographical note

Funding

UN SDGs

Research Keywords

RGC Funding Information

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

Projects

GRF: Detecting Non-Line-of-Sight Channel Spoofing in Time-of-Flight Ranging

Cite this