Organizations: Universit´e Lyon 1, Universit´e Lumi`ere Lyon 2, ERIC, 69100 Villeurbanne, France · School of Computer Science and Mathematics, Liverpool John Moores University, Liverpool, U.K.
Machine learning-based intrusion detection systems (IDS) are critical for securing Industrial Internet of Things (IIoT) environments. Most adversarial research against them perturbs the feature vector or the traffic that produces it, and depends on gradient access, repeated model queries, or a learned model of benign traffic. A smaller line of work reshapes packet timing without querying the detector, but makes malicious traffic mimic a learned model of benign timing. Across these approaches, one assumption of industrial monitoring pipelines has received little attention: temporal synchronization. An IDS reconstructs operational state by aggregating telemetry into sliding or tumbling windows, so its view depends not only on what is observed but on when each observation falls relative to a window boundary. We introduce the Phantom State Attack (PSA), which exploits that dependence under a passive, zero-query threat model. Rather than modifying packets, perturbing features, querying the classifier, or fitting any model of benign traffic, PSA injects bounded timing drift calibrated to the attack flow's own inter-arrival variability, moving observations across the nearest window boundary by the minimal shift needed. The IDS then reconstructs a phantom state that diverges from the true process state. We evaluate PSA on ToN-IoT and CIC IIoT 2025 (DataSense), against Random Forest, MLP and XGBoost, measuring detection degradation, synchronization distortion, stealth, and attacker cost. PSA degrades detection on flows carrying enough packets for window-boundary redistribution, and leaves others almost unchanged, so its effect is conditional. A query-based baseline reaches higher raw success but needs many queries per window, while PSA needs none. The results identify temporal aggregation as an attack surface reachable under weaker assumptions than prior evasion techniques.
Figures & tables
Fig. 1: General architecture of an ML-based intrusion detection system in IIoT environments. Industrial telemetry is aggregated into temporal observation windows ( Wt ), transformed into feature representations through a feature extraction process ( g(⋅) ), and analyzed by a machine learning model ( fθ ) to generate detection decisions.
Fig. 2: Temporal synchronization dependency in industrial monitoring systems. Timing offsets across telemetry streams may alter aggregation-window composition, modify extracted features, and affect the state reconstructed by the IDS.
Fig. 3: Phantom State Attack workflow. The attacker passively observes the timing of its own flow, selects synchronization-sensitive flows, injects flow-calibrated minimal-sufficient drift to move packets across the nearest aggregation-window boundary, and the IDS then reconstructs a distorted phantom state from the re-aggregated windows. Packet contents and order within the flow are unchanged.
Dataset
Description
Industrial Characteristics
ToN-IoT
Heterogeneous IoT/IIoT dataset providing both raw packet captures and Zeek/Bro-derived netflow logs with explicit per-record timestamps ( ts ), collected from normal and malicious telemetry across networked IoT and industrial environments
Fine-grained, millisecond-level timestamp fields enabling inter-arrival-time computation and controlled temporal drift injection at sub-window resolution; seven evaluated attack categories (backdoor, DoS, DDoS, scanning, MITM, ransomware, password) representative of industrial communication environments
CIC IIoT Dataset 2025 (DataSense) [ 20 ]
Recent industrial IDS benchmark built on a dedicated 40-device CIC/UNB testbed, providing synchronized sensor and network traffic streams across IoT/IIoT, edge, and cloud layers using real industrial protocols (Modbus TCP, OPC UA, MQTT)
Shorter, single-session captures with per-packet timestamps, providing an independent testbed whose traffic characteristics differ from ToN-IoT; seven evaluated attack categories (DoS, DDoS, malware, MITM, web-exploitation, brute-force, reconnaissance) representative of contemporary IIoT deployments. The cross-layer synchronization this benchmark provides motivates the multi-source extension discussed in Section VI ; the present evaluation uses single-flow timing only
TABLE I: Industrial datasets used for PSA evaluation.
Criterion Category
Criterion
Purpose
Detection Performance
Accuracy
Measures overall IDS classification performance under temporal desynchronization
Precision
Measures the reliability of malicious traffic detection
Recall
Measures the ability of the IDS to identify malicious activity after timing manipulation
F1-score
Provides a balanced evaluation of precision and recall
Attack Effectiveness
Attack Success Rate (ASR)
Measures the proportion of successful attack-induced classification changes achieved by PSA
Synchronization Distortion
Packet Redistribution Ratio (PRR)
Quantifies the proportion of telemetry observations redistributed across aggregation windows due to temporal manipulation
TABLE II: Evaluation criteria used for PSA assessment.
Dataset
Category
Accuracy ( Δt=1.00 )
ASR ( Δt=1.00 )
RF
MLP
XGB
RF
MLP
XGB
ToN-IoT
Backdoor
0.8141 ± 0.046
0.7492 ± 0.031
0.8579 ± 0.045
0.2247 ± 0.059
0.2347 ± 0.026
0.1699 ± 0.058
DoS
0.9780 ± 0.008
0.9292 ± 0.006
0.9725 ± 0.009
0.0078 ± 0.004
0.0138 ± 0.003
0.0100 ± 0.003
DDoS
0.9994 ± 0.000
0.9981 ± 0.000
0.9993 ± 0.000
0.0000 ± 0.000
0.0001 ± 0.000
0.0000 ± 0.000
Scanning
0.9955 ± 0.001
0.9843 ± 0.013
0.9960 ± 0.002
0.0016 ± 0.000
0.0110 ± 0.014
0.0010 ± 0.000
MITM ∗
0.6729 ± 0.275
0.6729 ± 0.275
0.6929 ± 0.294
0.0000 ± 0.000
0.0000 ± 0.000
0.0000 ± 0.000
TABLE III: Detection accuracy and Attack Success Rate (ASR) at minimum ( Δt=0.10 s) and maximum ( Δt=1.00 s) evaluated drift, across all fourteen categories. Values are mean ± std over 5 seeds.
Fig. 4: Accuracy and Attack Success Rate under PSA for the two categories exhibiting the strongest effects: ToN-IoT Ransomware (a, c) and DataSense DDoS (b, d), across four drift budgets. Error bars omitted for clarity; see Table III for standard deviations.
Fig. 5: Detector Evasion Rate (DER) against four synchronization-aware defenses under increasing drift (ToN-IoT Backdoor, the category with the most complete detector validation).
Category
PSA Queries
Query-Baseline Queries
Backdoor
0
29,120
DoS
0
21,930
DDoS
0
328,870
Scanning
0
2,030
MITM
0
10
Ransomware
0
15,360
TABLE IV: Model query cost: PSA vs. black-box query-based baseline (RF, ToN-IoT categories).
Fig. 6: (a) Physical Consistency Violation Rate (PCVR) for PSA across four representative categories, against the approximate range observed for unconstrained baseline attacks (shaded band). (b) Attacker query cost, PSA vs. query-based baseline, across seven ToN-IoT categories (log scale).
Work
Venue
Manipulated object
Interaction with detector
Additional requirement
Domain
Feature-space and query-driven evasion
Qiu et al. [ 24 ]
IEEE IoT-J 2021
Packet fields guided by salient features
Black-box access to train a shadow model
Shadow model, saliency map
IoT NIDS (Kitsune)
Yan et al. [ 25 ]
IEEE TDSC 2024
Traffic samples (morphing)
Label-only queries
Model extraction, transfer
Enterprise NIDS
Problem-space and traffic-space attacks
Han et al. [ 28 ]
IEEE JSAC 2021
Inter-arrival times, injected crafted packets
None (gray-box)
Known feature extractor, surrogate, GAN+PSO
Enterprise/IoT NIDS
Tan et al. [ 29 ]
IEEE TNSM 2022
Outbound live packets (atomic mutations)
Classifier outcome used as RL feedback †
Kalman feature predictor, SE-DQN agent
Enterprise NIDS
TABLE V: Comparison of representative adversarial attacks against learned intrusion and anomaly detectors, and of timing attacks on industrial infrastructure. “Interaction” is the access the adversary needs to the deployed detector at attack-construction time.
Intrusion detection in IoT and industrial networks requires models that can detect rare attacks at low false-positive rates while remaining reliable under evolving traffic and limited labels. Existing IDS solutions often report strong in-distribution accuracy, but they may degrade when evaluated on future traffic, unseen (zero-day) attack families, or adversarial feature manipulations, and many systems provide limited evidence to support analyst triage. To address these gaps, we propose ThreatFormer- IDS, a Transformer-based sequence modeling framework that converts flow records into time-ordered windows and learns contextual representations for robust intrusion screening. The method combines (i) weighted supervised learning for imbalanced detection, (ii) masked self-supervised learning to improve representation stability under drift and sparse labels, (iii) PGDbased adversarial training with scale-normalized perturbations to strengthen resilience against feature-level evasion, and (iv) Integrated Gradients attribution to highlight influential time steps and features for each alert. On the ToN IoT benchmark with chronological evaluation, ThreatFormer-IDS achieves AUCROC 0.994, AUC-PR 0.956, and Recall@1%FPR 0.910, outperforming strong tree-based and sequence baselines. Under a zero-day protocol with held-out attack families, it maintains superior generalization (AUC-PR 0.721, Recall@1%FPR 0.783). Robustness tests further show slower degradation in AUCPR as the adversarial budget increases, confirming improved stability under bounded perturbations. Overall, ThreatFormer- IDS provides a unified, deployment-oriented IDS pipeline that balances detection quality, zero-day behavior, robustness, and explainability.
The rapid expansion of Industrial IoT (IIoT) systems has amplified security challenges, as heterogeneous devices and dynamic traffic patterns increase exposure to sophisticated and previously unseen cyberattacks. Traditional intrusion detection systems often struggle in such environments due to their reliance on extensive labeled data and limited ability to detect new threats. To address these challenges, we propose MI2DAS, a multi-layer intrusion detection framework that integrates anomaly-based hierarchical traffic pooling, open-set recognition to distinguish between known and unknown attacks and incremental learning for adapting to novel attack types with minimal labeling. Experiments conducted on the Edge-IIoTset dataset demonstrate strong performance across all layers. In the first layer, GMM achieves superior normal-attack discrimination (accuracy = 0.953, TPR = 1.000). In open-set recognition, GMM attains a recall of 0.813 for known attacks, while LOF achieves 0.882 recall for unknown attacks. For fine-grained classification of known attacks, Random Forest achieves a macro-F1 of 0.941. Finally, the incremental learning module maintains robust performance when incorporation novel attack classes, achieving a macro-F1 of 0.8995. These results showcase MI2DAS as an effective, scalable and adaptive framework for enhancing IIoT security against evolving threats.
Wei Lian, Alejandro Guerra-Manzanares
School of Computer Science, University of Nottingham, Ningbo, China
Radio frequency jamming poses a critical threat to the availability of wireless Industrial Internet of Things (IIoT) networks. Existing detection and classification techniques are poorly suited to this setting: coarse signal-strength and cross-layer features lack information richness, while raw I/Q baseband approaches require hardware and throughput that is impractical at the scale of hundred-node IIoT deployments. This paper presents CITADEL, a lightweight two-stage hierarchical pipeline that uses only Channel State Information (CSI) measurements, which are natively available on commodity IIoT devices, to detect and classify jamming attacks including previously unseen ones. While prior work has shown that jamming leaves observable CSI signatures, CITADEL is the first system to translate this insight into an end-to-end pipeline that jointly achieves closed-set classification of known attacks, open-set detection of zero-day attacks, and resistance to adversarial evasion. Evaluated across 6 known attack types and 15 zero-day scenarios, CITADEL achieves 100% known-attack detection and 97.1% zero-day detection at a 0.4% end-to-end false positive rate. Under adversarial evaluation spanning white-box and black-box threat models, gradient-based evasion remains below 2% across all tested perturbation budgets and the strongest published CSI attack generator achieves less than 5% average evasion. A systematic comparison against eight baselines confirms that no existing method achieves comparable performance on CSI data across all three axes: detection, generalization, and robustness. The full pipeline completes inference in 14.2 ms at 95.9 mJ on an edge GPU, establishing CITADEL as a practical solution for large-scale IIoT network security.
Aymen Bouferroum, Ildi Alla, Valeria Loscri +2
FUN · Inria Lille-Nord Europe, Lille, France · uni.lu +3