The rapid advancement and growing integration of IoMT technologies have significantly increased the vulnerability of medical systems and the surface area of potential attacks. Recently, sophisticated attacks have emerged that are difficult to detect using traditional detection systems, such as cross-protocol attacks. In this study, we propose an innovative framework that focuses on detecting cross-protocol attacks in IoMT environments by in-depth analysis of the features in the CICIoMT2024 dataset. The methodology included data cleaning, designing advanced features using PCA and hierarchical clustering, and training and evaluating the decision tree (DT) and random forest (RF) algorithms. The evaluation revealed consistently high performance across all key metrics, reaching an accuracy of 99%, a precision of 99.9%, and an F1-score of 99% in identifying complex attack patterns, confirming the proposed approach’s efficiency and paving the way for smarter and safer deployment of intelligent medical technologies in evolving IoMT infrastructures.