Energy-efficient meta-classifier model for log access anomaly detection in healthcare systems

As technology evolves and becomes more widely adopted in the healthcare industry, the more vulnerable to attacks the patients’ sensitive health data and clinical operations become (Abirami et al., 2020; Kiziloz, 2021). This happens in part due to the increasing usage of electronic health records (EHRs), which lead to the threat of unauthorised access and data breaches, with severe consequences for patient privacy, institutional trust and regulatory compliance (Nguyen et al., 2020; Jain et al., 2022). These security concerns have been further intensified by the increasing burden of chronic diseases, the expansion of interconnected healthcare systems and the transition toward digital diagnostic technologies – factors that underscore the need for robust monitoring capabilities (Khan et al., 2022). In light of these developments, the demand for advanced, dependable and interpretable anomaly detection solutions capable of real-time protection of access logs within healthcare infrastructures has become increasingly urgent (Ali et al., 2022a, b; Swaminathan and Palani, 2022).

Conventional access monitoring techniques, including rule-based alerts and manual audits, are often limited in scope and adaptability. While rule-based systems offer transparency and are favoured for their explainability, they typically struggle to capture complex, context-dependent behaviours or to detect novel attack patterns in dynamic healthcare environments (Kiziloz, 2021; Nguyen et al., 2020; Kumar et al., 2022). These limitations have pushed for learning-based approaches, including autoencoders, recurrent neural networks and feature fusion methods, which are more sensitive than the aforementioned methods (Abirami et al., 2020; Xu et al., 2022; Kora and Mohammed, 2023), with the downside that they are frequently impacted by extreme class imbalance, scarcity of labelled data and the computational demands of real-time deployment (Ali et al., 2022a, b; Ackerson et al., 2021).

Recent research has increasingly turned to ensemble and hybrid models, which combine the strengths of multiple detection paradigms. Notably, meta-classifier frameworks that integrate signals from unsupervised models, supervised learners and domain-inspired rules have achieved substantial gains in anomaly recall, robustness and interpretability (Ali et al., 2022a, b; Kiziloz, 2021; Sarmah et al., 2024; Swaminathan and Palani, 2022). Meta-learning and ensemble adaptation methods that adjust to dataset complexity and feature interactions further enhance anomaly classification performance across evolving contexts (Da Silva et al., 2021; Ullah and Mahmoud, 2022). In parallel, the development of lightweight deep learning architectures has expanded the design space for efficient anomaly detection. For example, a lightweight transformer model based on feature fusion and a global–local parallel stacked self-activation unit has demonstrated strong performance while reducing computational demands, making it particularly relevant for real-time and resource-constrained environments (Liu et al., 2024; Mienye and Swart, 2024). Such advances align with the growing demand for energy-efficient and scalable solutions, where the environmental footprint and operational cost of anomaly detection systems are critical considerations, especially for institutions with constrained IT resources (Nguyen et al., 2020; Bouza Heguerte et al., 2023; Fu et al., 2022; Bhuiyan et al., 2023).

Although there have been many advances, studies are often confined to synthetic datasets or controlled settings, limiting their real-world applicability (Ali et al., 2022a, b; Sarmah et al., 2024). Moreover, there remains an urgent need for practical frameworks that balance accuracy, efficiency and transparency, enabling healthcare security teams to respond effectively to evolving threats. The protection of electronic health records has become a critical concern, with numerous studies highlighting the risks of unauthorised access and insider threats (Ali et al., 2022a, b). Literature reviews further underscore the need for interpretable and adaptive anomaly detection frameworks tailored to sensitive healthcare environments (Rahman et al., 2024).

This article addresses these gaps by proposing an energy-efficient meta-classifier model for anomaly detection in healthcare access logs. Unlike existing hybrid or ensemble approaches, which have primarily been applied to domains such as intrusion detection or fraud detection, this framework combines multiple heterogeneous detection signals – including autoencoder-based reconstruction scores, supervised LightGBM outputs, rule-based indicators and contextual metadata – within a modular and interpretable architecture explicitly designed for healthcare operations. The modular design enables each component to contribute complementary strengths: unsupervised models capture subtle deviations, supervised learners leverage labelled patterns, rule-based features enforce domain knowledge and contextual metadata provides organisational and behavioural insight.

The fundamental advancement of this approach lies not simply in combining existing methods, but in how these heterogeneous signals are integrated in a unified, energy-efficient and interpretable decision layer, optimised for the specific constraints and demands of clinical environments. This design allows the meta-classifier to effectively handle highly imbalanced datasets, detect rare and context-dependent anomalies, and maintain low computational and energy overhead – features that are essential for real-time deployment in hospital IT systems. More specifically, the research gap identified in the study highlights three key limitations in current healthcare anomaly detection systems: (1) reliance on single-method approaches (rule-based or purely machine learning) that fail to capture complex, context-dependent anomalies; (2) the lack of energy-efficient and interpretable solutions suitable for real-time clinical deployment and (3) the scarcity of frameworks validated on realistic access log scenarios. By addressing these limitations, the proposed meta-classifier offers a methodological and practical advancement, demonstrating that carefully designed hybrid architectures can provide not only improved detection performance but also operational feasibility and domain-specific applicability in healthcare settings.

Accordingly, two research questions are established for this work:

RQ1 examines whether a hybrid meta-classifier that integrates unsupervised, supervised and rule-based features can overcome the limited sensitivity and adaptability of traditional approaches when used in a realistic dataset (gaps 1 and 3). This directly targets the need for higher recall and robustness in detecting subtle and previously unseen insider threats, as identified in the literature. RQ2 evaluates whether the proposed framework can achieve this improved detection performance while maintaining low computational and energy overhead, thereby addressing the operational and environmental concerns highlighted in recent studies (gap 2). By addressing these questions, this study seeks to advance the state-of-the-art in healthcare anomaly detection, offering a solution that is not only accurate and interpretable but also efficient and adaptable to the operational realities of modern healthcare institutions.

The structure of this article is as follows. The Literature Review Section reviews the theoretical foundations and evolution of anomaly detection in healthcare, with an emphasis on hybrid and meta-classifier approaches. The Methodology Section details the methodology used, encompassing synthetic dataset generation, model construction and evaluation definition, as well as baseline and comparative state-of-the-art models used for comparison. The Results Section compares the results of evaluating the proposed framework against the baseline and comparative models, using both detection metrics and energy efficiency. The Discussion Section discusses implications, limitations and opportunities for real-world adoption. The Conclusion wraps up by summarising the main insights and outlining possible directions for future research. The research flow progresses from theory (Section 2), to methodological design (Section 3), empirical evaluation (Section 4), critical reflection (Section 5) and final considerations (Section 6).

Anomaly detection in healthcare systems draws from a diverse set of theoretical frameworks, reflecting the evolving challenges of protecting sensitive electronic health records (EHRs) in increasingly complex environments. Early approaches were rooted in expert systems theory and symbolic reasoning, where domain experts encoded decision rules to flag unusual access patterns (Nguyen et al., 2020). Such rule-based systems were valued for their transparency and alignment with the interpretability imperative in clinical IT, drawing from foundational principles in decision theory and explainable artificial intelligence (Kiziloz, 2021). However, symbolic approaches soon revealed limitations. Anomaly detection theory states that as threats diversify and systems scale, fixed rule sets often lack the adaptability required to capture subtle or previously unseen attacks (Ali et al., 2022a, b). This theoretical challenge, coupled with the exponential growth in healthcare data, motivated the transition to statistical and machine learning (ML) paradigms (Abirami et al., 2020).

The introduction of unsupervised learning models, especially autoencoders, marked a major shift in the field. Grounded in the idea that “normal” behaviour can be statistically learned and deviations measured via reconstruction error, autoencoders enabled anomaly detection without reliance on extensive labelled data (Abirami et al., 2020). However, while powerful, these models often struggle with context-dependent or sophisticated threats, highlighting the limitations identified by anomaly detection theory, namely, the trade-off between sensitivity and generalisability (Nguyen et al., 2020). Deep learning models remain central to healthcare anomaly detection, with autoencoders and CNN-LSTM hybrids achieving strong performance in detecting subtle or context-dependent anomalies (Duraj et al., 2025; Yan et al., 2023). LSTMs have been widely adopted for sequence-based anomaly detection due to their ability to model temporal dependencies (Qiu et al., 2024; Wang et al., 2025). In addition, graph-based approaches such as GNNs have also been explored to capture temporal and relational patterns in access logs (Rahman et al., 2024; Fu et al., 2022; Rosero-Montalvo et al., 2023).

To address these gaps, the field evolved towards ensemble learning and hybrid approaches, informed by statistical learning theory and the bias-variance trade-off. Ensemble methods such as stacking and boosting combine multiple base learners to mitigate individual weaknesses and achieve higher accuracy (Ali et al., 2022a, b; Abirami et al., 2020). Hybrid frameworks increasingly blend unsupervised models (e.g. autoencoders) with supervised learners (e.g. LightGBM), integrating domain knowledge through binary rule-based features (Kiziloz, 2021; Nguyen et al., 2020; Zheng et al., 2025). In particular, the integration of contextual metadata – such as user role, department or typical access patterns – has proven to be a powerful enhancer of detection accuracy while reducing false positives (Nzeako and Shittu, 2024).

A significant theoretical and practical advance in recent years has been the adoption of meta-classifier architectures. These models, built upon the concept of modular learning systems, heterogeneous signals, autoencoder reconstruction scores, supervised model outputs, rule violations and contextual metadata into a single predictive decision (Abirami et al., 2020). The meta-classifier framework exemplifies the integration of symbolic reasoning and statistical inference, reflecting current trends in explainable AI and human-in-the-loop systems (Kiziloz, 2021). Research consistently shows that hybrid and meta-classifier models outperform standalone detectors, particularly in domains with extreme class imbalance (Hosseinzadeh et al., 2021; Meryem and El Ouahidi, 2020; Jain et al., 2022), limited labelled data, and high operational stakes, such as healthcare (Ali et al., 2022a, b; Abirami et al., 2020). In addition, ensemble learning and meta-classifiers have consistently shown superior performance in improving recall (Alabdulatif, 2025; Alsaffar et al., 2024; Mahajan et al., 2023).

Recent advances in sequence-based and graph-based anomaly detection have introduced far more sophisticated alternatives. Transformer-based models (e.g. BERT variants, LogBERT or self-attention architectures for sequential log data) have demonstrated state-of-the-art performance by capturing long-range dependencies in event streams, effectively addressing the limitations of RNNs and LSTMs in handling vanishing gradients and limited temporal horizons (Anggrainingsih et al., 2024; Hong et al., 2024). Their ability to model contextual relationships across entire sequences allows them to detect subtle irregularities that may only become evident when considering global dependencies, which is particularly relevant for log analysis and complex temporal data. Likewise, advanced Graph Neural Networks (GNNs) leverage the structural and relational properties of log data, enabling anomaly detection by modelling dependencies across entities, attributes and time (Dai et al., 2024). GNNs are particularly powerful in environments where the interactions among components or processes form intricate relational patterns, as is often the case in distributed systems, cybersecurity, or healthcare monitoring. Khemani et al. (2024) note that by embedding nodes and edges into high-dimensional latent spaces, GNNs can capture both local and global topological patterns, identifying anomalies that manifest not only in isolated events but also in the structure of relationships themselves.

In parallel, growing concerns about energy efficiency and the environmental impact of ML models have prompted some studies to report metrics beyond accuracy – such as training time, inference latency, and carbon emissions – advocating for detection methods that are both robust and sustainable (Różycki et al., 2025; Shobanke et al., 2025). It is also worth noting that energy-consumption-aware modelling has been widely studied in other domains, such as building energy management, where deep learning has been used to optimise resource utilisation (Kömürcü and Edis, 2025). Energy-efficient and low-latency anomaly detection has become especially critical for clinical IT systems (Dixit et al., 2022; Jabed and Majharul, 2023; Scarpato et al., 2024), with several studies advocating lightweight and modular models for resource-constrained environments (Hassan et al., 2023). Real-time energy-efficient solutions have also been demonstrated in other high-throughput systems, such as optical networks (Singh et al., 2025), and interpretable energy-efficient models, such as those leveraging SHAP-based feature analysis (e.g. LightGBM), have been applied successfully in energy management domains (Cui et al., 2024), successfully proving that this is a current technological possibility.

Despite these advancements, current research is often limited by the use of synthetic or constrained datasets, which may not capture the full diversity of real-world access behaviour (Ali et al., 2022a, b). There is a recognised need for further empirical validation in operational settings, as well as for new techniques that balance sensitivity, efficiency and interpretability in the rapidly changing healthcare environments (Christopoulou, 2024; Kiziloz, 2021) and more generally in AI (Burkart and Huber, 2021; Brereton et al., 2023). There is also the need for environmentally responsible ML with calls for standardised carbon footprint reporting in AI research (Manikandan et al., 2025; Jabed and Majharul, 2023).

To illustrate the evolution of anomaly detection methods and to underscore the contribution of this work, Table 1 compares key approaches in terms of methodology, strengths, limitations and research gaps addressed. This structured overview highlights how the proposed energy-efficient meta-classifier advances beyond existing solutions.

This study used an experimental and model-development approach. It combined machine learning techniques with domain-inspired rule modelling. The objective was to create a hybrid anomaly detection framework for healthcare access logs. This methodology was chosen because healthcare data has unique characteristics and needs for anomaly detection. Healthcare access logs are vast in volume and highly sensitive, since they include records related to patient privacy and compliance with regulations such as GDPR and HIPAA (Conduah et al., 2025; Nikolovski and Petreska, 2025). Traditional rule-based systems are interpretable and align with compliance auditing. However, they are often rigid and cannot adapt to new misuse patterns. In contrast, machine learning methods capture complex patterns and generalise from historical data. Yet, they may lack interpretability and be vulnerable to overfitting in high-dimensional, imbalanced healthcare datasets.

By integrating both rule-based and machine learning approaches, this study aimed to harness their complementary strengths to create a more intelligent and adaptable detection system. The domain-inspired rules add a crucial layer of explainability, embedding established regulatory and organisational norms directly into the model’s logic (Dash et al., 2022). Meanwhile, the machine learning components enhance adaptability, enabling the system to uncover previously unseen or subtle anomalies that rigid rule sets might overlook (Miller et al., 2024). Together, this hybrid design merges the interpretability of expert-driven knowledge with the adaptive learning power of data-driven methods, resulting in a more resilient and context-aware framework than either paradigm could achieve alone.

Alternative methodologies were considered but were found to be less suited to the study’s objectives. A purely qualitative approach, for instance, could have provided valuable insights into practitioner perceptions or organisational practices but would lack the empirical rigor needed to evaluate detection performance. Similarly, a simulation-based study might have explored hypothetical attack scenarios but would not capture the richness and unpredictability of real-world data. Even within quantitative methods, an exclusive reliance on statistical anomaly detection or deep learning could have yielded higher performance in narrow cases, yet at the cost of transparency and operational trustworthiness, which are indispensable in healthcare environments.

Accordingly, the hybrid experimental and model-development design adopted in this study represents a balanced methodological choice. It enables rigorous performance assessment through quantitative evaluation, while grounding the framework in practical, domain-relevant knowledge. The use of standard detection metrics and energy-efficiency indicators, as used previously in studies such as Bian et al. (2021), Mathew et al. (2023), and Tien et al. (2022), further ensures that the framework is not only effective but also scalable and sustainable in real-world healthcare infrastructures.

Because real patient access data is highly sensitive, publicly available datasets for studying healthcare access behaviour are scarce. To address this gap, we developed a synthetic healthcare access log generator designed to simulate realistic interactions within a hospital setting. The resulting dataset includes 50,000 normal and 500 labelled anomalous access events, providing a rich foundation for studying insider threat detection in healthcare environments. Our work builds on the growing movement toward synthetic healthcare data generation (Hernandez et al., 2022), which seeks to balance data privacy with realism. Unlike previous approaches that primarily model patient outcomes, our generator focuses on access behaviour, embedding domain-informed rule violations to reflect common insider threat scenarios. Each log entry captures essential identity and behavioural features (i.e. user ID, role, department, timestamp, patient ID, action type, IP address, access location and purpose of access), offering a comprehensive view of both context and intent. This design allows for the detection of nuanced anomalies, such as role misuse or cross-departmental access, which are frequently associated with insider breaches. While the synthetic dataset provides a controlled and reproducible testbed for benchmarking anomaly detection models, we recognise its current limitations in representing real-world complexities. Consequently, future research will aim to validate the framework using authentic hospital access logs, contingent on ethical and privacy approvals. Importantly, our meta-classifier’s modular architecture supports easy adaptation to operational healthcare systems. This flexibility enables the integration of real-world metadata – including departmental hierarchies, user access norms and temporal activity trends – enhancing model relevance and accuracy. Furthermore, the generator can evolve to incorporate emerging threat patterns and institution-specific policies, ensuring that models trained on synthetic data remain effective and trustworthy in real clinical environments.

According to HIPAA (2025), covered entities are required to regularly review system activity, including audit logs and access reports, with unauthorised or off-hours log access being a key indicator of a privacy breach. The timestamp allows for temporal pattern recognition and detection of off-hours access. Patient ID and purpose of access are crucial for legitimacy – ensuring that the user’s actions align with their clinical duties (Hernandez et al., 2022). IP address and access location support geospatial and network-level anomaly detection, such as identifying external access or unauthorised terminals.

This structured, multi-dimensional representation mirrors the complexity of real-world access logs found in electronic health record systems and is essential for training AI models that simulate realistic hospital security scenarios. Anomalies are injected according to a predefined catalogue of five rule violations: off-hours access, unauthorised role usage, external IP usage, cross-department access and accessing the wrong patient pool. These categories reflect common real-world threat scenarios based on the log entry defined.

Figure 1 provides a global picture of the model architecture. We designed a hybrid detection framework with the following components:

1. Autoencoder (AE): Trained on normal samples to learn latent representations. AE reconstruction error was used as a proxy anomaly score;

2. LightGBM Classifier: Trained on autoencoder embeddings to classify both normal and anomalous patterns using a supervised gradient boosting model;

3. Rule-Based Features: Binary flags were generated for each rule violation type. These flags serve as interpretable indicators and incorporate expert knowledge;

4. Contextual Features: Role and department attributes were encoded and added to enhance context awareness;

5. Meta-classifier (LightGBM): A final layer combined AE scores, LightGBM outputs, rule flags and context features to make the final anomaly prediction. This fusion approach allows for modular integration of diverse signals.

A stratified train-test split (80/20) was used to evaluate all models. The autoencoder was trained only on normal samples, while the LightGBM and meta-classifier used both normal and anomalous labelled events. We report standard classification metrics: precision, recall, F1-score and accuracy.

Precision and recall represent the correctness and completeness of positive predictions, respectively, and F1-score balances the two. Due to the importance of minimising false negatives because of their possible consequences in this context, we emphasise recall and F1-score for the anomaly class. To ensure fair comparisons, all models were optimised through systematic parameter tuning. Hyperparameters were selected via stratified cross-validation on the training set, with grid and random search strategies applied depending on model complexity (e.g. grid search for smaller models such as GAE/VGAE and random search for high-dimensional models such as transformers). The selection criterion prioritised maximising the anomaly-class F1-score, while preventing overfitting through early stopping and validation monitoring. Additionally, statistical robustness was assessed by averaging results across five independent runs with different random seeds. Confidence intervals for key metrics (recall and F1-score) were computed using bootstrapping, and paired t-tests were conducted to confirm the significance of performance differences between the proposed meta-classifier and baseline models. This combination of parameter tuning and statistical validation strengthens the reliability of the reported findings and ensures that improvements are not due to chance or overfitting.

All experiments were run using Python libraries such as scikit-learn, LightGBM and NumPy. Carbon emissions during training and inference were tracked using CodeCarbon to assess energy efficiency (Bouza Heguerte et al., 2023).

To assess the effectiveness of our proposed hybrid meta-classifier, we implemented and evaluated several baseline and comparative models drawn from current anomaly detection literature. These models serve as reference points to contextualise the strengths and weaknesses of our final approach.

The proposed Role-Aware Prototype Model incorporates organisational context into anomaly scoring. Separate prototype clusters are learned for each user role (e.g. nurse, doctor, admin), allowing the system to model normal behaviour patterns conditional on functional responsibilities.

This approach is similar in spirit to context-aware strategies used in prior work (Rahman et al., 2025). This allows for role-sensitive anomaly detection but increases complexity due to multiple role-specific clusters. This model was evaluated but ultimately not used in the final design when a standalone LightGBM model gave similar results.

The proposed CPAD model uses a K-Means clustering algorithm to identify centroids of normal access behaviour in the autoencoder latent space. Anomalies are detected based on the minimum Euclidean distance from each test point to the nearest cluster centre. This approach, similar to techniques proposed by Jain et al. (2022), assumes that normal behaviour clusters tightly in latent space and deviations represent outliers. CPAD is lightweight and unsupervised, making it a valuable benchmark for early-stage anomaly detection, but it could still improve on recall and F1-scores, which led us to experiment and finally come to the final proposed meta-classifier model.

A supervised LightGBM classifier was trained on the autoencoder (trained only on normal data) embeddings of access logs. Although trained using labelled normal and anomalous samples, the LightGBM was limited to operating on latent features alone, without explicit rules or contextual signals. This model allowed us to evaluate how well supervised gradient boosting can separate anomalies in embedding space alone.

However, while these decoupled architectures can be efficient, they might lack the domain-specific context needed for high-precision anomaly segmentation in complex environments like healthcare access logs (Finke et al., 2021).

We implemented a long short-term memory (LSTM) model to capture temporal dependencies in access log sequences. Logs were tokenised and ordered to reflect access sessions. The LSTM was trained to predict the next event or score entire sequences, with anomalies identified based on prediction error or sequence likelihood.

LSTM-based models have been widely used in anomaly detection across domains such as IoT (Abdallah et al., 2021), system logs (Rahman et al., 2025), and email and network traffic classification (Ackerson et al., 2021), demonstrating their ability to model temporal patterns and sequential anomalies. However, their performance can degrade when applied to irregular or sparse access sequences, as found in healthcare settings.

A GNN was constructed using access graphs where nodes represented users and patients, and edges captured interactions with contextual features (e.g. time, role). Node embeddings were learned via message passing, and anomaly scores were derived based on graph structure deviation.

Recent research in domains like infrastructure and water systems (Fu et al., 2022) supports the efficacy of GNNs in structured anomaly detection. In our study, this model served as a benchmark to assess how structured modelling compares with our modular feature-fusion approach.

A purely rule-based baseline was also evaluated. This system triggers alerts based on violations of handcrafted rules (e.g. off-hours access, cross-department viewing). While highly interpretable and fast, the rule-based model lacks adaptability and fails to generalise to novel or subtle anomalies (Swaminathan and Palani, 2022).

As noted by Kumar et al. (2022), such systems provide a useful low-complexity benchmark but are insufficient in isolation for high-stakes anomaly detection tasks in dynamic environments. Its performance serves as a lower-bound reference.

Our proposed model combines AE reconstruction scores, LightGBM prediction probabilities, binary rule-based flags (e.g. off-hours access, unauthorised role) and contextual metadata (e.g. user role, department). These heterogeneous features are passed to a LightGBM classifier, which learns to fuse multiple weak signals into a unified anomaly decision. Similar hybrid and meta-classifier approaches have been shown to improve robustness in high-dimensional and imbalanced contexts (Ali et al., 2022a, b; Sainin et al., 2021; Sarmah et al., 2024). This layered, modular design aims to improve anomaly recall without sacrificing interpretability or efficiency.

This section presents the results of our experimental evaluation, which aimed to compare the performance of various anomaly detection models on synthetic healthcare access logs. We focus on both detection metrics (precision, recall, F1-score, accuracy) and computational efficiency, including energy consumption and inference latency. The primary goal was to identify models that offer a favourable trade-off between anomaly recall and practical deployment considerations.

Table 2 summarises the performance of seven evaluated models. Precision, Recall and F1-score relate to the anomaly class only, whereas Accuracy is for the overall detection. The meta-classifier, which fuses AE scores, LightGBM probabilities, rule-based violations, and contextual metadata, achieved the highest anomaly F1-score (0.8989) and recall (0.8180), while maintaining an overall accuracy of 98.33%.

In contrast, the Deep AE + LightGBM model demonstrated a strong overall accuracy of 93.13%, yet its limited anomaly recall of 0.2780 revealed challenges in capturing the full spectrum of irregular behaviours. The LSTM model showed a similar pattern, achieving high precision (0.8851) but a low recall (0.2610), suggesting that sequence-based architectures, while effective in structured IT system logs, struggle with the sparse and heterogeneous nature of healthcare access data. The Rule-Based system, by comparison, achieved excellent recall (0.8080) and perfect precision (1.000), confirming its reliability in detecting well-defined violations. However, its rigidity made it ill-suited for identifying subtle or emerging anomalies. This shortcoming underscores the advantage of the proposed meta-classifier, which combines the interpretability of rule-based detection with the adaptability of data-driven models to better capture complex and evolving access behaviours.

Other methods performed more modestly. Graph-based models, such as the GAE and VGAE, delivered competitive performance (F1-scores of 0.8268 and 0.8409, respectively) with high recall (0.7400), reflecting their ability to exploit structural relationships in access data. However, newer approaches like Edge-Aware Transformer GNN and LogBERT underperformed in recall (0.1900 and 0.2100, respectively), which constrained their F1-scores despite achieving perfect precision.

Finally, models tailored to contextual or prototype-based reasoning (i.e. CPAD and the Role-Aware Prototype) did not meet expectations. While CPAD achieved perfect precision, its recall was very low (0.2400), and the Role-Aware Prototype further degraded generalisation, yielding the lowest F1-score overall (0.2394) and accuracy (83.71%). This suggests that while contextual sensitivity can be valuable, over-specialisation may harm robustness.

While tabular metrics provide a clear summary of comparative performance, they offer only a partial view of a model’s behaviour. To further illustrate the robustness of the meta-classifier, Figure 2 presents its receiver operating characteristic (ROC) curve. This visualisation highlights the trade-off between true positive and false positive rates across varying thresholds, demonstrating the model’s ability to maintain high discriminative power under different operational conditions. Complementing this, Figure 3 depicts the confusion matrix for the meta-classifier, which reveals the distribution of correct and incorrect predictions in greater detail. The matrix makes explicit the balance between false negatives and false positives, thereby offering a more interpretable account of how the model prioritises sensitivity versus specificity.

All models were evaluated not only for accuracy but also for their environmental and computational efficiency, including training time, inference latency, and carbon emissions per run, as shown in Table 3. The rule-based method emerged as the most lightweight, completing training in just 1.44 s and generating an almost negligible carbon footprint (6.77e−08 kg CO₂). Yet, its limited adaptability and relatively high inference latency (0.260 ms) restricted its scalability in dynamic healthcare environments. Among the learning-based approaches, the graph autoencoders (GAE and VGAE) stood out for their remarkable efficiency, training in under 11 s, producing minimal emissions (≈4e−05 kg CO₂), and achieving near-instantaneous inference (0.0001 ms per sample). Although highly sustainable and resource-efficient, their detection performance lagged behind the meta-classifier. At the other extreme, transformer-based models such as LogBERT and TranAD imposed substantial computational costs. LogBERT required over 6,680 s of training, emitted 0.0278 kg CO₂ and exhibited high inference latency (25.51 ms), rendering it impractical for real-time healthcare monitoring. TranAD showed similar demands, with lengthy training (4,172 s) and elevated emissions. In contrast, the proposed meta-classifier achieved a strong balance between accuracy and efficiency: despite its ensemble design, it trained in under 200 s, maintained modest emissions (0.00124 kg CO₂) and delivered fast inference (0.028 ms per sample), making it both operationally viable and environmentally responsible while maintaining superior anomaly detection performance.

Considering RQ1, our experimental results support a positive answer to this question. The proposed meta-classifier, which integrates autoencoder reconstruction errors, LightGBM prediction scores, rule-based violation flags and contextual metadata, achieved the highest anomaly detection performance among all evaluated models, except for the purely rule-based approach. It reached an F1-score of 0.8989 and a recall of 0.8180, surpassing both standalone and ensemble baselines. In comparison, the Deep AE combined with LightGBM attained an F1-score of only 0.4238, while the LSTM model, despite achieving high precision (0.8851), struggled with recall (0.2610), reflecting limited sensitivity to diverse anomaly types. The rule-based system showed strong recall (0.8080) for predefined violations but failed to detect unknown or context-dependent anomalies, and its performance largely depended on meticulously crafted rules that would be unrealistic in most real-world settings. These findings demonstrate that the meta-classifier’s integration of multiple heterogeneous indicators significantly enhances both sensitivity and robustness, particularly when addressing subtle or behaviourally complex access violations.

Regarding RQ2, the meta-classifier also demonstrated a favourable trade-off between accuracy and computational efficiency. Inference latency was measured at approximately 0.04 milliseconds, on par with the lightweight rule-based system. Although the rule-based baseline had the lowest training time and carbon footprint, it lacked adaptability. The meta-classifier, in contrast, retained high accuracy (98.33%) and interpretability while maintaining low energy overhead, making it suitable for near real-time deployment in constrained clinical environments. These results suggest that the proposed hybrid framework is not only effective in detecting anomalies, but also operationally feasible for production use in healthcare systems.

This study set out to improve anomaly detection in healthcare access logs using a novel approach by integrating multiple weak signals – statistical, machine-learned and rule-based – into a unified and interpretable hybrid model. The results indicate several important findings, both confirming and extending previous research.

Previous studies have shown that unsupervised autoencoder-based models, though effective in learning normal behaviour, often suffer from low anomaly recall in real-world access logs due to the diversity and subtlety of malicious activity (Lin et al., 2020; Yan et al., 2023). This limitation was confirmed in our evaluation, where both Deep AE + LightGBM and CPAD achieved high precision (≥0.90) but exhibited poor recall (≤0.28), indicating that while they reliably detect clear deviations, they struggle with more subtle or context-dependent anomalies, such as off-hours access or cross-department requests.

Similarly, sequence models like LSTM, successful in domains with structured event patterns (e.g. system logs, IoT), demonstrated limited generalisability in our dataset. Their reliance on consistent temporal ordering does not align with the sparse and heterogeneous nature of healthcare access behaviour, where critical anomalies may occur sporadically or without predictable sequences (Abdallah et al., 2021; Rahman et al., 2025).

The use of purely rule-based systems has been widely adopted in anomaly detection due to their simplicity, transparency and ease of interpretation (Metta et al., 2024). In our experiments, the implementation achieved high precision and recall for anomalies that matched the predefined rule set, effectively capturing all injected violations. However, this performance is heavily dependent on the alignment between the rules and the specific anomalies present in the dataset. Any anomaly that falls outside the predefined catalogue – such as subtle deviations in access patterns, cross-department queries or atypical sequences of operations – remains undetected. This limitation arises because rule-based systems lack adaptive reasoning or contextual understanding; they rely entirely on explicit conditions and cannot generalise to unforeseen scenarios. The observed high recall in our evaluation is therefore artificially inflated due to the perfect correspondence between the injected anomalies and the rule definitions, a scenario that rarely occurs in production environments where malicious behaviour is diverse and evolving.

Broad reviews of anomaly detection techniques continue to recommend hybrid approaches as the most promising strategy for balancing precision and recall in sensitive domains (Das et al., 2024; Santhosh et al., 2021). Our findings reinforce this view: models that combine multiple detection signals – including reconstruction errors, contextual metadata, gradient-boosted predictions and rule-based violations – show improved capability to identify both overt and subtle anomalies. Nonetheless, further analysis is required to systematically classify which types of novel anomalies remain challenging, such as low-frequency deviations or behaviour that partially conforms to normal patterns, highlighting directions for future model refinement and evaluation.

Our most notable finding is that a meta-classifier architecture, which fuses reconstruction-based anomaly scores, supervised model outputs, rule violations and user context, achieves both high recall (0.8180) and high precision (0.9976), resulting in an F1-score of 0.8989. This performance exceeds all individual models and is particularly important in healthcare, where the cost of missed anomalies can be severe.

Unlike prior work focusing on a single detection strategy – such as unsupervised autoencoders (Yan et al., 2023), deep sequence models (Rahman et al., 2025) or latent variable frameworks (Lin et al., 2020)—our framework enables modular fusion of heterogeneous features, supporting detection of both known (rule-defined) and unknown (behavioural) anomalies. The integration of contextual metadata (e.g. role, department) further enhances discrimination between legitimate and suspicious actions, particularly in grey-zone scenarios such as off-hours or cross-department access.

While ensemble approaches have been shown to improve classification and generalisation (Abirami et al., 2020; Kiziloz, 2021) and stacked or adaptive architectures have been advocated for robustness across domains (Nguyen et al., 2020; Dey and Mathur, 2023), our approach extends these principles by explicitly addressing lightweight, modular design for healthcare environments. Unlike monolithic Transformer-based systems, the framework maintains efficiency without compromising detection performance, enabling near real-time deployment.

We also report energy consumption and inference latency, which is rarely addressed in anomaly detection literature. Consistent with Hassan et al. (2023), modular fusion architectures are more energy-efficient than deep monolithic models. Our final meta-classifier demonstrates low environmental impact and fast inference, reinforcing its practicality for real-time monitoring in healthcare infrastructures.

The key contributions offered by this study can be summarised:

1. A novel hybrid detection architecture that fuses symbolic rules, learned features and behavioural embeddings into a unified, interpretable model;

2. A practical demonstration of modular fusion of multiple weak signals to boost anomaly recall without sacrificing precision or efficiency;

3. Empirical benchmarking of common and other proposed models (e.g. LSTM, CPAD, Role-Aware Prototypes, Transformers models and GNNs) under the same controlled dataset;

4. Inclusion of carbon and latency profiling, an often-overlooked dimension of machine learning deployment in computationally weak environments.

These results suggest that combining symbolic rules with statistical and learned features can dramatically improve both sensitivity and robustness of anomaly detection in sensitive domains like healthcare.

First, our findings demonstrate that fusing heterogeneous signals – unsupervised anomaly scores, supervised model outputs, rule-based flags and contextual metadata – substantially improves detection performance in EHR access logs compared to relying on any single method. This highlights the limitations of one-detection-type approaches and supports a shift towards modular, hybrid architectures for insider threat detection in healthcare.

Second, our framework shows that it is possible to maintain high anomaly recall without sacrificing interpretability or computational efficiency. This is particularly relevant for clinical IT environments, where real-time monitoring is critical, but resources are often constrained. By integrating low-latency components and tracking energy usage, our model meets operational requirements that are frequently overlooked in academic anomaly detection research.

Third, the successful use of a synthetic yet realistic EHR access dataset underscores the importance of developing and sharing high-quality, privacy-preserving simulation tools. This dataset design – rooted in known rule violations and behavioural irregularities – can serve as a testbed for evaluating future detection models in healthcare and beyond. Nevertheless, we acknowledge that reliance on synthetic data raises valid concerns about real-world applicability. To address this, future work will focus on validating the proposed framework against real hospital access logs, subject to ethical approvals and data-sharing agreements. Moreover, the modular architecture of the meta-classifier is inherently adaptable to real-world healthcare environments: contextual features (e.g. user roles, departmental structures, temporal access norms) can be directly mapped to operational datasets, enabling seamless deployment. This dual approach, synthetic prototyping followed by real-world validation, ensures both methodological rigor and clinical relevance.

Finally, our results have implications for policy and compliance auditing. The model’s modularity allows security teams to trace detection outputs back to human-understandable rules or behavioural indicators, aligning with explainability requirements in regulated environments. This positions our approach as not only technically effective but also ethically responsible.

Across extensive experiments on a synthetic yet realistic dataset, the proposed meta-classifier achieved the highest performance among all tested models, with an F1-score of 0.8989, recall of 0.8180 and precision of 0.9976 for detecting anomalies, with an overall accuracy of 98.33%. Accordingly, this study demonstrates that the proposed meta-classifier provides a robust and practical solution for anomaly detection in healthcare access logs. The findings highlight the benefits of combining diverse detection mechanisms into a unified framework. The meta-classifier not only improves anomaly detection performance but also ensures efficiency and scalability, making it well-suited for deployment in clinical settings where real-time responsiveness and reliability are essential. By integrating multiple detection signals (i.e. reconstruction errors, gradient-boosted predictions, contextual metadata and rule-based violations), the meta-classifier effectively captures both obvious and subtle anomalies, outperforming conventional approaches such as deep autoencoders, LSTMs, and prototype-based methods. While rule-based systems can achieve comparable recall in some cases, their rigidity limits adaptability to new or evolving attack patterns, a limitation that the meta-classifier successfully overcomes. Graph-based models leverage structural relationships in access data and offer computational efficiency, but their detection performance falls short of the hybrid approach. Transformer-based models, though theoretically powerful, impose prohibitive training costs and latency, reducing their practicality in real-time monitoring. The meta-classifier strikes an optimal balance, delivering high detection accuracy and robustness while maintaining low computational overhead and energy consumption.

Despite the promising results, this study has several limitations that should be acknowledged. First, the dataset, while designed to be realistic, remains synthetic and may not fully capture the variability, edge cases, and noise typically present in real-world access logs. Such factors can significantly influence anomaly detection performance, especially when irregular user behaviour is subtle or context-dependent. Second, although the rule-based components were carefully handcrafted to mimic real violations, they may still require substantial adaptation to reflect the policies, workflows and threat landscapes of specific healthcare institutions or HER systems.

Future research will address these challenges and extend the scope of the present work in multiple directions. A priority is the validation of the proposed framework on real EHR audit datasets, obtained under strict privacy-preserving protocols, to better evaluate generalisability and robustness in operational environments. Another avenue is the exploration of federated learning and secure multi-party computation techniques, which would enable collaborative model training across institutions without compromising sensitive patient data. Additionally, incorporating temporal dynamics more explicitly, through advanced sequence models or hybrid graph–temporal architectures, could enhance the detection of long-term or evolving anomalous patterns.

Further research could also investigate the explainability of the framework, developing mechanisms that make anomaly alerts more interpretable for auditors and clinicians. This would strengthen trust and facilitate integration into daily security operations. Moreover, energy efficiency, already considered in this study, could be analysed in greater depth by comparing the environmental impact of different anomaly detection approaches under varying scales of deployment. Finally, integrating the framework with broader cybersecurity and compliance monitoring systems or extending it to cross-domain audit scenarios beyond healthcare, could expand its practical relevance and adaptability.