<![CDATA[Web-based telemedicine systems are exposed to cyber threats that may affect the confidentiality, integrity, and availability of healthcare services. This study develops a domain oriented cybersecurity baseline by reorganizing selected CIC-IDS2017 traffic into five classes relevant to web-based telemedicine: Normal, Port Scan, Brute Force, Web Application Attack, and DoS/DDoS. After cleaning, 1,698,296 observations were retained. A leakage-aware pipeline was applied using an 80:20 stratified split, training-derived preprocessing, 63 locked predictors, standardization fitted only on the training partition, and Moderate Random Undersampling applied exclusively to training data. Logistic Regression served as the primary interpretable baseline, while Decision Tree, Random Forest, and Linear SVM were included only for comparative validation. Evaluation on an untouched test set of 339,660 observations showed that Logistic Regression achieved 94.62% accuracy, 58.70% Macro-F1, 99.40% macro ROC-AUC, and 61.73% macro PR-AUC. Strong performance was observed for Normal, Port Scan, and DoS/DDoS, whereas Web Application Attack remained difficult to distinguish and was frequently misclassified as Brute Force. These findings indicate that network-flow features provide a useful benchmark-level baseline, while application-oriented attacks require additional authentication, application-layer, and SIEM-correlated evidence.]]>
Copyrights © 2026
