## 2 Materials and Methods
### Data Source and Collection  
Our deep learning model is evaluated using the ECU-IoHT dataset, which includes both normal network activity and cyber-attacks in the healthcare domain. The dataset's generation involves an environment equipped with specific components, notably a Windows 10 operating system, Kali Linux, a mobile Wi-Fi hotspot, a wireless network adapter, and a Bluetooth adapter, all interconnected to enable internet access for the hosts. In addition, the environment incorporates a healthcare kit named MySignals, equipped with multiple sensors designed for monitoring and recording patients' physiological data, encompassing metrics like body temperature, blood pressure, and heart rate. These sensor-generated data are subsequently transmitted to users' cloud storage. The ECU-IoHT dataset encompasses seven key network data features: source, destination, protocol, and specific attack types. Within the dataset, 23,453 instances represent normal network activity, while other instances correspond to cyber-attack instances. These attacks are classified into four distinct types: Address Resolution Protocol (ARP) spoofing, Denial-of-Service (DoS) attacks, Network Mapper (Nmap) port scans, and Smurf attacks. ARP spoofing involves sending false Address Resolution Protocol messages to associate the attacker's MAC address with the IP address of a legitimate network device, leading to data interception. DoS attacks aim to overwhelm a target system with excessive requests, rendering it unavailable to legitimate users. Nmap port scans involve probing a network to identify open ports and services, aiding in vulnerability assessment. Smurf attacks exploit IP broadcast addressing to flood a target system with ICMP echo requests, causing network congestion and disruption. The ECU-IoHT dataset is used to train and evaluate the model, ensuring its suitability for healthcare applications. Notably, this method significantly improves detection accuracy by analyzing a substantial volume of data, with the ECU-IoHT dataset comprising a total of 111,207 samples, as presented in Figure 1.  
A comprehensive multi-stage quality assurance protocol is crucial for maintaining the integrity and reliability of a dataset used in deep learning for cyber-attack detection in IoHT environments. The process starts by gathering and combining data from public sources, then cleaning missing data and standardizing it for accuracy and consistency. A thorough relevance assessment is conducted on the dataset, consistency checks are performed on network data features, and validation is carried out to verify its appropriateness for model training. Recognizing the importance of iterative data preprocessing, the protocol mandates regular evaluations and adjustments to optimize the dataset's contribution to building a robust detection system.  
The performance requirements for the deep learning-based cyber-attack detection system in the IoHT environment are crucial to achieving our research objectives. The model must exhibit exceptional accuracy, recall, and precision performance to effectively identify and classify a wide range of cyber-attacks while minimizing false detections. Efficiently handling a dataset of 111,207 samples is essential. Additionally, the system's performance should be reliable and consistently effective across different scenarios and data variations. Moreover, the strategy must achieve a low false positive rate in detecting and responding to cyber threats, reflecting the real-time requirements of the IoHT environment where timely action is critical.  
Achieving performance requirements is vital to ensure the proposed deep learning approach contributes significantly to strengthening cybersecurity in IoHT, enhancing the security of sensitive medical data, and ultimately guaranteeing the well-being of patients.