## 5 Case Study for Mitigating Security Attacks in Smart Healthcare System
### Performance Evaluation of the Proposed Architecture  
This section discusses the evaluation of the proposed architecture's performance evaluation by applying different metrics, such as accuracy, scalability, and internal details of the malware from the dynamic analysis. For dynamic malware analysis, we utilized PEstudio, which provides an initial malware assessment that consists of malware indicators, important strings, directories, sections, resources, file headers, manifest files, and certificates. Here, we analysed various malware samples of smart healthcare systems that target web-based resources and patient data. For example, one malware sample (md5-584B853E5F597883 FB56 CC5E879 DBA3D), written in C++, specifically targets the web-based login credentials using functions, such as \(get\_Browser()\), \(GetSavedPassword()\), \(GetSavedCookies\), \(GetValueNames()\), \(urlHistroy()\), \(getPasswordHash()\), and many more (as shown in Figure 6). Further, they imported different malicious and illegitimate dynamic link libraries (DLL) and application programming interfaces (API), such as \(dmpushproxy.dll\), \(dmenterrisediagnostics.dll\) to spoof the user into installing malicious executable files as shown in Figure 7. In addition, it contains another graphical user interface (GUI) executable file that propagates its attack surface once installed on the victim's physical device. Further, Figure 8 shows the evaluation of the intelligence layer, where different AI-based algorithms are trained using a standard dataset and validated using a generated dataset from the malware samples. Here, the RF outperforms other algorithms in terms of accuracy, i.e., 93.14%, because RF splits the entire dataset into small samples (as a decision  
Figure 6: Malicious functions used in malware sample. Figure 7: Malicious DLL used in malware sample. tree) by using split node criteria. Then, each sample is individually trained, and the best decision tree is chosen using majority voting (highest accuracy). Nevertheless, the other AI algorithms are not optimized compared to RF because they need a few hyperparameters so as to achieve good accuracy. Table 5 shows the performance analysis of the proposed architecture in terms of precision, recall, log-loss score, and F1 score. Here, RF outperforms in terms of precision, recall, log-loss score, and F1 score, i.e., 93.24%, 92.99%, 6.34%, and 93.67%, respectively compared to other AI models. Specifically, the accuracy parameter shows how efficiently an AI model predicts the output. The higher the accuracy score, the higher the AI model's prediction performance. Conversely, the log-loss score shows an error in the prediction output, i.e., the higher the log-loss score, the lower the AI model's prediction performance and vice-versa. Figure 9 illustrates the scalability comparison of the blockchain network. The proposed architecture applies an IPFS-based blockchain that uses hash data to store in the immutable ledger, unlike the conventional blockchain, which uses raw data. The incorporation of IPFS improves the response time of the blockchain network because one can more easily fetch the hash data from the blockchain network compared to the raw data, resulting in a quick response time. This implies the higher the response time, the higher the scalability of the proposed architecture. It is clear from the Figure 9 that the IPFS-based blockchain has greater scalability than the conventional blockchain. The proposed architecture achieves a better performance compared to the existing state-of-the-art models. For instance, [7] proposed a lightweight and intelligent framework to protect medical devices from security threats, and they achieved an accuracy of 87.57% to predict the network-based attack. Conversely, the proposed architecture uses different AI models, wherein the RF achieves an accuracy of 93.14% compared to [7] in detecting attacks on smart healthcare systems.