# Explainable AI Assisted IoMT Security in Future 6G Networks
## 4 Materials and Methods  
The experiments were conducted using Python 3.10 in a Google Colab environment with GPU acceleration to enhance computational efficiency. TensorFlow (v2.17.1) and Keras (v3.5.0) were used for model development and training, while Matplotlib (v3.10.0) and Seaborn (v0.13.2) supported result visualization. This setup ensured efficient processing, robust model development, and clear visual insights--key for building trust and security in intelligent 6G networks. For analysis, we used a comprehensive, publicly available dataset designed for security research in medical networks [15]. The dataset comprises 77 features across 145K samples--132K normal and 13K attack instances--capturing both network and host-based attributes. The testbed includes a core network, local network, multi-access edge computing (MEC) servers, user equipment (UE), and a routing system. To simulate realistic threat scenarios, tools like Simu5G and Stateful IP/ICMP Translation (SIIT) were integrated. The dataset highlights four major threats, each representing a critical security challenge in medical network environments, as shown in Figure 4:  
* Man-in-the-Middle (MiTM): This attack involves intercepting and potentially modifying communications between two parties, thereby enabling unauthorized access to sensitive information. * Distributed Denial-of-Service (DDoS): In this type of attack, adversaries inundate systems with excessive traffic, depleting resources and resulting in service disruptions or complete outages. * Ransomware: A form of malicious software that encrypts critical organizational data and demands a ransom for its decryption, leading to significant disruption of routine operations. Figure 3: Healthcare applications and security implications of 6G usage scenarios in IoMT environments. * Buffer overflow: This attack exploits vulnerabilities in memory management to inject and execute malicious code, which can compromise the integrity and security of the system. Although this dataset was originally designed for 5G, its structure and complexity make it highly suitable for evaluating AI-driven security frameworks in 6G environments. It aligns with the ITU-R IMT-2030 framework (M.2160) depicted in Figure 5, which envisions 6G as an evolution of 5G, incorporating both enhanced capabilities and entirely new features. Building on the foundation established by 5G, 6G introduces innovations such as native AI integration, sub-terahertz (THz) communication, reconfigurable intelligent surfaces (RISs), and integrated sensing and communication (ISAC), while also improving areas like spectrum efficiency, energy efficiency, and network resilience. This dataset is particularly relevant for evaluating the resilience and adaptability of security frameworks in the 6G context, as it includes critical network components such as routers, servers, and MEC nodes. Moreover, the dataset simulates network conditions like high bandwidth, ultra-low latency, and diverse traffic scenarios, reflecting the core characteristics of 6G, particularly relevant for mission-critical healthcare applications such as robotic surgeries and AI-assisted diagnostics. It also incorporates security-specific data, such as traffic logs and simulated attack patterns, making it indispensable for 6G healthcare threat modeling. By addressing IPv6/IPv4 compatibility and including a range of cyber threats, including IoT-based attacks  
Figure 4: Visualization plot of different class types and their counts. Figure 5: The capabilities of IMT—2030 (source: ITU—R M.2160). and network anomalies, it provides a solid foundation for developing and testing advanced security solutions for future wireless networks. Also, given the unavailability of 6G network data, this dataset remains the most reliable resource for evaluating potential security threats and developing mitigations, particularly in the context of healthcare applications in the forthcoming 6G era. After data collection, we addressed class imbalances, especially in attack subclasses, using standard SMOTE [26].