Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models

Saadullah Farooq Abbasi; Muhammad Bilal; Xuefei Ding; Linxue Bai; Omid Pournik; Saif Ul Islam; Gregory Epiphaniou; Carsten Maple; Theodoros N. Arvanitis

doi:10.3233/SHTI260323

Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models

Saadullah Farooq Abbasi
, Muhammad Bilal
, Xuefei Ding
, Linxue Bai
, Omid Pournik
, Saif Ul Islam
, Gregory Epiphaniou
, Carsten Maple
, Theodoros N. Arvanitis^*

^*Corresponding author for this work

Electronic, Electrical and Systems Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

16 Downloads (Pure)

Abstract

The Internet of Medical Things (IoMT) is growing exponentially with the advancements in image processing, large language models (LLMs), and other technologies. However, processing patient-identifiable information (PII) in cloud environments raises significant security and compliance concerns. Existing tools provide baseline threat detection; however, they miss complex vulnerabilities. Researchers used cloud-based LLMs such as GPT or Claude to enhance detection, however, these approaches compromise privacy. For this reason, this study proposes a locally deployed and cost-efficient LLM specifically, Llama 3.1 (8B parameters), to identify additional threats and recommend mitigation strategies. The locally deployed Llama 3.1 model identified 12 additional cyberthreats beyond SPYDERISK improving detection coverage and preserving privacy.

Original language	English
Title of host publication	Opening the Personal Gate between Technology and Health Care
Subtitle of host publication	Proceedings of MIE 2026
Editors	Mauro Giacomini, Jaime Delgado, Theodoros N. Arvanitis, Elisavet Andrikopoulou, Arriel Benis, Gabriella Balestra, Riccardo Bellazzi, Parisis Gallos, Roberto Gatta, Daniele Roberto Giacobbe, Noemi Giordano, Maria Hägglund, Lars Lindsköld, Lenka Lhotska, Sara Marceglia, Enea Parimbelli, Lucia Sacchi, Paolo Soda, Lăcrămioara Stoicu-Tivadar, Pierangelo Veltri, Patrizia Vizza
Publisher	IOS Press
Pages	969-973
Number of pages	5
ISBN (Electronic)	9781643686615
DOIs	https://doi.org/10.3233/SHTI260323
Publication status	Published - 21 May 2026
Event	36th Medical Informatics Europe Conference, MIE 2026: Opening the Personal Gate between Technology and Health Care - Magazzini del Cotone, Genoa, Italy Duration: 25 May 2026 → 28 May 2026 https://mie2026.efmi.org/

Publication series

Name	Studies in Health Technology and Informatics
Publisher	IOS Press
Volume	336
ISSN (Print)	0926-9630
ISSN (Electronic)	1879-8365

Conference

Conference	36th Medical Informatics Europe Conference, MIE 2026
Abbreviated title	EFMI MIE2026
Country/Territory	Italy
City	Genoa
Period	25/05/26 → 28/05/26
Internet address	https://mie2026.efmi.org/

Keywords

Information Security
Internet of Medical Things
Large Language Models
Threat Modeling

ASJC Scopus subject areas

Biomedical Engineering
Health Informatics
Health Information Management

Access to Document

10.3233/SHTI260323Licence: Creative Commons: Attribution-NonCommercial (CC BY-NC)

AbbasiSF2026SecureFinal published version, 250 KBLicence: Creative Commons: Attribution-NonCommercial (CC BY-NC)

1 Finished
1 Active

INSAFEDARE: INNOVATIVE APPLICATIONS OF ASSESSMENT AND ASSURANCE OF DATA AND SYNTHETIC DATA FOR REGULATORY DECISION SUPPORT
Arvanitis, T. (Principal Investigator)
UKRI Horizon Europe Underwriting Innovate UK
1/11/23 → 31/10/26
Project: Other Government Departments
MEDSECURANCE - Advanced Security-for-safety Assurance for Medical Device IoT
Arvanitis, T. (Principal Investigator)
UKRI Horizon Europe Underwriting Innovate UK
1/01/23 → 31/12/25
Project: Other Government Departments

Cite this

Abbasi, S. F., Bilal, M., Ding, X., Bai, L., Pournik, O., Islam, S. U., Epiphaniou, G., Maple, C., & Arvanitis, T. N. (2026). Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models. In M. Giacomini, J. Delgado, T. N. Arvanitis, E. Andrikopoulou, A. Benis, G. Balestra, R. Bellazzi, P. Gallos, R. Gatta, D. R. Giacobbe, N. Giordano, M. Hägglund, L. Lindsköld, L. Lhotska, S. Marceglia, E. Parimbelli, L. Sacchi, P. Soda, L. Stoicu-Tivadar, P. Veltri, ... P. Vizza (Eds.), Opening the Personal Gate between Technology and Health Care: Proceedings of MIE 2026 (pp. 969-973). (Studies in Health Technology and Informatics; Vol. 336). IOS Press. https://doi.org/10.3233/SHTI260323

Abbasi, Saadullah Farooq ; Bilal, Muhammad ; Ding, Xuefei et al. / Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models. Opening the Personal Gate between Technology and Health Care: Proceedings of MIE 2026. editor / Mauro Giacomini ; Jaime Delgado ; Theodoros N. Arvanitis ; Elisavet Andrikopoulou ; Arriel Benis ; Gabriella Balestra ; Riccardo Bellazzi ; Parisis Gallos ; Roberto Gatta ; Daniele Roberto Giacobbe ; Noemi Giordano ; Maria Hägglund ; Lars Lindsköld ; Lenka Lhotska ; Sara Marceglia ; Enea Parimbelli ; Lucia Sacchi ; Paolo Soda ; Lăcrămioara Stoicu-Tivadar ; Pierangelo Veltri ; Patrizia Vizza. IOS Press, 2026. pp. 969-973 (Studies in Health Technology and Informatics).

@inproceedings{16c72b405abb4387b8d7fac3c130a0cb,

title = "Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models",

abstract = "The Internet of Medical Things (IoMT) is growing exponentially with the advancements in image processing, large language models (LLMs), and other technologies. However, processing patient-identifiable information (PII) in cloud environments raises significant security and compliance concerns. Existing tools provide baseline threat detection; however, they miss complex vulnerabilities. Researchers used cloud-based LLMs such as GPT or Claude to enhance detection, however, these approaches compromise privacy. For this reason, this study proposes a locally deployed and cost-efficient LLM specifically, Llama 3.1 (8B parameters), to identify additional threats and recommend mitigation strategies. The locally deployed Llama 3.1 model identified 12 additional cyberthreats beyond SPYDERISK improving detection coverage and preserving privacy.",

keywords = "Information Security, Internet of Medical Things, Large Language Models, Threat Modeling",

author = "Abbasi, \{Saadullah Farooq\} and Muhammad Bilal and Xuefei Ding and Linxue Bai and Omid Pournik and Islam, \{Saif Ul\} and Gregory Epiphaniou and Carsten Maple and Arvanitis, \{Theodoros N.\}",

year = "2026",

month = may,

day = "21",

doi = "10.3233/SHTI260323",

language = "English",

series = "Studies in Health Technology and Informatics",

publisher = "IOS Press",

pages = "969--973",

editor = "Mauro Giacomini and Jaime Delgado and Arvanitis, \{Theodoros N.\} and Elisavet Andrikopoulou and Arriel Benis and Gabriella Balestra and Riccardo Bellazzi and Parisis Gallos and Roberto Gatta and Giacobbe, \{Daniele Roberto\} and Noemi Giordano and Maria H{\"a}gglund and Lars Lindsk{\"o}ld and Lenka Lhotska and Sara Marceglia and Enea Parimbelli and Lucia Sacchi and Paolo Soda and L{\u a}cr{\u a}mioara Stoicu-Tivadar and Pierangelo Veltri and Patrizia Vizza",

booktitle = "Opening the Personal Gate between Technology and Health Care",

address = "Netherlands",

note = "36th Medical Informatics Europe Conference, MIE 2026 : Opening the Personal Gate between Technology and Health Care, EFMI MIE2026 ; Conference date: 25-05-2026 Through 28-05-2026",

url = "https://mie2026.efmi.org/",

}

Abbasi, SF, Bilal, M, Ding, X, Bai, L, Pournik, O, Islam, SU, Epiphaniou, G, Maple, C & Arvanitis, TN 2026, Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models. in M Giacomini, J Delgado, TN Arvanitis, E Andrikopoulou, A Benis, G Balestra, R Bellazzi, P Gallos, R Gatta, DR Giacobbe, N Giordano, M Hägglund, L Lindsköld, L Lhotska, S Marceglia, E Parimbelli, L Sacchi, P Soda, L Stoicu-Tivadar, P Veltri & P Vizza (eds), Opening the Personal Gate between Technology and Health Care: Proceedings of MIE 2026. Studies in Health Technology and Informatics, vol. 336, IOS Press, pp. 969-973, 36th Medical Informatics Europe Conference, MIE 2026, Genoa, Italy, 25/05/26. https://doi.org/10.3233/SHTI260323

Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models. / Abbasi, Saadullah Farooq; Bilal, Muhammad; Ding, Xuefei et al.
Opening the Personal Gate between Technology and Health Care: Proceedings of MIE 2026. ed. / Mauro Giacomini; Jaime Delgado; Theodoros N. Arvanitis; Elisavet Andrikopoulou; Arriel Benis; Gabriella Balestra; Riccardo Bellazzi; Parisis Gallos; Roberto Gatta; Daniele Roberto Giacobbe; Noemi Giordano; Maria Hägglund; Lars Lindsköld; Lenka Lhotska; Sara Marceglia; Enea Parimbelli; Lucia Sacchi; Paolo Soda; Lăcrămioara Stoicu-Tivadar; Pierangelo Veltri; Patrizia Vizza. IOS Press, 2026. p. 969-973 (Studies in Health Technology and Informatics; Vol. 336).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models

AU - Abbasi, Saadullah Farooq

AU - Bilal, Muhammad

AU - Ding, Xuefei

AU - Bai, Linxue

AU - Pournik, Omid

AU - Islam, Saif Ul

AU - Epiphaniou, Gregory

AU - Maple, Carsten

AU - Arvanitis, Theodoros N.

PY - 2026/5/21

Y1 - 2026/5/21

N2 - The Internet of Medical Things (IoMT) is growing exponentially with the advancements in image processing, large language models (LLMs), and other technologies. However, processing patient-identifiable information (PII) in cloud environments raises significant security and compliance concerns. Existing tools provide baseline threat detection; however, they miss complex vulnerabilities. Researchers used cloud-based LLMs such as GPT or Claude to enhance detection, however, these approaches compromise privacy. For this reason, this study proposes a locally deployed and cost-efficient LLM specifically, Llama 3.1 (8B parameters), to identify additional threats and recommend mitigation strategies. The locally deployed Llama 3.1 model identified 12 additional cyberthreats beyond SPYDERISK improving detection coverage and preserving privacy.

AB - The Internet of Medical Things (IoMT) is growing exponentially with the advancements in image processing, large language models (LLMs), and other technologies. However, processing patient-identifiable information (PII) in cloud environments raises significant security and compliance concerns. Existing tools provide baseline threat detection; however, they miss complex vulnerabilities. Researchers used cloud-based LLMs such as GPT or Claude to enhance detection, however, these approaches compromise privacy. For this reason, this study proposes a locally deployed and cost-efficient LLM specifically, Llama 3.1 (8B parameters), to identify additional threats and recommend mitigation strategies. The locally deployed Llama 3.1 model identified 12 additional cyberthreats beyond SPYDERISK improving detection coverage and preserving privacy.

KW - Information Security

KW - Internet of Medical Things

KW - Large Language Models

KW - Threat Modeling

U2 - 10.3233/SHTI260323

DO - 10.3233/SHTI260323

M3 - Conference contribution

C2 - 42174997

T3 - Studies in Health Technology and Informatics

SP - 969

EP - 973

BT - Opening the Personal Gate between Technology and Health Care

A2 - Giacomini, Mauro

A2 - Delgado, Jaime

A2 - Arvanitis, Theodoros N.

A2 - Andrikopoulou, Elisavet

A2 - Benis, Arriel

A2 - Balestra, Gabriella

A2 - Bellazzi, Riccardo

A2 - Gallos, Parisis

A2 - Gatta, Roberto

A2 - Giacobbe, Daniele Roberto

A2 - Giordano, Noemi

A2 - Hägglund, Maria

A2 - Lindsköld, Lars

A2 - Lhotska, Lenka

A2 - Marceglia, Sara

A2 - Parimbelli, Enea

A2 - Sacchi, Lucia

A2 - Soda, Paolo

A2 - Stoicu-Tivadar, Lăcrămioara

A2 - Veltri, Pierangelo

A2 - Vizza, Patrizia

PB - IOS Press

T2 - 36th Medical Informatics Europe Conference, MIE 2026

Y2 - 25 May 2026 through 28 May 2026

ER -

Abbasi SF, Bilal M, Ding X, Bai L, Pournik O, Islam SU et al. Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models. In Giacomini M, Delgado J, Arvanitis TN, Andrikopoulou E, Benis A, Balestra G, Bellazzi R, Gallos P, Gatta R, Giacobbe DR, Giordano N, Hägglund M, Lindsköld L, Lhotska L, Marceglia S, Parimbelli E, Sacchi L, Soda P, Stoicu-Tivadar L, Veltri P, Vizza P, editors, Opening the Personal Gate between Technology and Health Care: Proceedings of MIE 2026. IOS Press. 2026. p. 969-973. (Studies in Health Technology and Informatics). doi: 10.3233/SHTI260323

Secure and Enhanced Cyber-Threat Detection in IoMT Using Locally Deployed Large Language Models

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Fingerprint

Projects

INSAFEDARE: INNOVATIVE APPLICATIONS OF ASSESSMENT AND ASSURANCE OF DATA AND SYNTHETIC DATA FOR REGULATORY DECISION SUPPORT

MEDSECURANCE - Advanced Security-for-safety Assurance for Medical Device IoT

Cite this