An Ontology-Driven AI Framework for Context-Aware Threat Detection in Mobile Health Applications

Abstract

Mobile health (mHealth) applications have substantially improved the accessibility of healthcare, enabling remote monitoring, chronic-disease management, and personalized interventions. However, because these applications collect and transmit sensitive personal health information on resource-constrained mobile devices, they introduce significant security and privacy risks, including weak authentication, unsafe data sharing, and a lack of awareness of user context (Luxton et al., 2012; Aljedaani & Babar, 2021). Traditional, signature-based security methods are largely static and frequently fail to adapt to the changing situations in which mobile users operate, leaving context-dependent threats poorly addressed.

This thesis proposes a context-aware mHealth security architecture and develops an OWL 2 DL contextual ontology in Protégé. It separately evaluates a candidate machine-learning (ML) detection component on a network-intrusion benchmark. The architectural integration is a design proposition; its effect on detection performance has not been tested.

The empirical work consists of a Python/scikit-learn classification pipeline applied to NSL-KDD network-connection records, following the publicly available Kaggle notebook by josiagiven (n.d.). The ontology is a design artefact. The Android context-collection layer, ontology-to-ML transformation, mitigation module, and on-device application were designed but not implemented or empirically evaluated. To preserve participant privacy and satisfy ethical requirements, no real patient data were used.

The appendix records point estimates from a validation split, including Decision Tree accuracy of 0.983, KNN accuracy of 0.995, and Linear SVC accuracy of 0.981; the displayed Random Forest confusion matrix contains no errors and reports AUC = 1.00. These unusually high scores require verification for leakage and proxy features before being interpreted as reliable out-of-sample performance. The different ranges in Table 4.4 are retained as originally reported but cannot be identified as estimates from that same run without the fold-level records.

Latency below 150 ms and CPU utilization below 12% were proposed design targets. No Android deployment or device resource measurement was carried out.

The contribution is a specified ontology and mHealth security architecture together with an offline benchmark evaluation of a candidate ML detection layer. Whether semantic enrichment improves detection or an on-device implementation is feasible remains open to empirical testing.