Organizations: Universit´e Lyon 1, Universit´e Lumi`ere Lyon 2, ERIC, 69100 Villeurbanne, France · School of Computer Science and Mathematics, Liverpool John Moores University, Liverpool, U.K.
Machine learning-based intrusion detection systems (IDS) are critical for securing Industrial Internet of Things (IIoT) environments. Most adversarial research against them perturbs the feature vector or the traffic that produces it, and depends on gradient access, repeated model queries, or a learned model of benign traffic. A smaller line of work reshapes packet timing without querying the detector, but makes malicious traffic mimic a learned model of benign timing. Across these approaches, one assumption of industrial monitoring pipelines has received little attention: temporal synchronization. An IDS reconstructs operational state by aggregating telemetry into sliding or tumbling windows, so its view depends not only on what is observed but on when each observation falls relative to a window boundary. We introduce the Phantom State Attack (PSA), which exploits that dependence under a passive, zero-query threat model. Rather than modifying packets, perturbing features, querying the classifier, or fitting any model of benign traffic, PSA injects bounded timing drift calibrated to the attack flow's own inter-arrival variability, moving observations across the nearest window boundary by the minimal shift needed. The IDS then reconstructs a phantom state that diverges from the true process state. We evaluate PSA on ToN-IoT and CIC IIoT 2025 (DataSense), against Random Forest, MLP and XGBoost, measuring detection degradation, synchronization distortion, stealth, and attacker cost. PSA degrades detection on flows carrying enough packets for window-boundary redistribution, and leaves others almost unchanged, so its effect is conditional. A query-based baseline reaches higher raw success but needs many queries per window, while PSA needs none. The results identify temporal aggregation as an attack surface reachable under weaker assumptions than prior evasion techniques.
Figures & tables
Fig. 1: General architecture of an ML-based intrusion detection system in IIoT environments. Industrial telemetry is aggregated into temporal observation windows ( Wt ), transformed into feature representations through a feature extraction process ( g(⋅) ), and analyzed by a machine learning model ( fθ ) to generate detection decisions.
Fig. 2: Temporal synchronization dependency in industrial monitoring systems. Timing offsets across telemetry streams may alter aggregation-window composition, modify extracted features, and affect the state reconstructed by the IDS.
Fig. 3: Phantom State Attack workflow. The attacker passively observes the timing of its own flow, selects synchronization-sensitive flows, injects flow-calibrated minimal-sufficient drift to move packets across the nearest aggregation-window boundary, and the IDS then reconstructs a distorted phantom state from the re-aggregated windows. Packet contents and order within the flow are unchanged.
Dataset
Description
Industrial Characteristics
ToN-IoT
Heterogeneous IoT/IIoT dataset providing both raw packet captures and Zeek/Bro-derived netflow logs with explicit per-record timestamps ( ts ), collected from normal and malicious telemetry across networked IoT and industrial environments
Fine-grained, millisecond-level timestamp fields enabling inter-arrival-time computation and controlled temporal drift injection at sub-window resolution; seven evaluated attack categories (backdoor, DoS, DDoS, scanning, MITM, ransomware, password) representative of industrial communication environments
CIC IIoT Dataset 2025 (DataSense) [ 20 ]
Recent industrial IDS benchmark built on a dedicated 40-device CIC/UNB testbed, providing synchronized sensor and network traffic streams across IoT/IIoT, edge, and cloud layers using real industrial protocols (Modbus TCP, OPC UA, MQTT)
Shorter, single-session captures with per-packet timestamps, providing an independent testbed whose traffic characteristics differ from ToN-IoT; seven evaluated attack categories (DoS, DDoS, malware, MITM, web-exploitation, brute-force, reconnaissance) representative of contemporary IIoT deployments. The cross-layer synchronization this benchmark provides motivates the multi-source extension discussed in Section VI ; the present evaluation uses single-flow timing only
TABLE I: Industrial datasets used for PSA evaluation.
Criterion Category
Criterion
Purpose
Detection Performance
Accuracy
Measures overall IDS classification performance under temporal desynchronization
Precision
Measures the reliability of malicious traffic detection
Recall
Measures the ability of the IDS to identify malicious activity after timing manipulation
F1-score
Provides a balanced evaluation of precision and recall
Attack Effectiveness
Attack Success Rate (ASR)
Measures the proportion of successful attack-induced classification changes achieved by PSA
Synchronization Distortion
Packet Redistribution Ratio (PRR)
Quantifies the proportion of telemetry observations redistributed across aggregation windows due to temporal manipulation
TABLE II: Evaluation criteria used for PSA assessment.
Dataset
Category
Accuracy ( Δt=1.00 )
ASR ( Δt=1.00 )
RF
MLP
XGB
RF
MLP
XGB
ToN-IoT
Backdoor
0.8141 ± 0.046
0.7492 ± 0.031
0.8579 ± 0.045
0.2247 ± 0.059
0.2347 ± 0.026
0.1699 ± 0.058
DoS
0.9780 ± 0.008
0.9292 ± 0.006
0.9725 ± 0.009
0.0078 ± 0.004
0.0138 ± 0.003
0.0100 ± 0.003
DDoS
0.9994 ± 0.000
0.9981 ± 0.000
0.9993 ± 0.000
0.0000 ± 0.000
0.0001 ± 0.000
0.0000 ± 0.000
Scanning
0.9955 ± 0.001
0.9843 ± 0.013
0.9960 ± 0.002
0.0016 ± 0.000
0.0110 ± 0.014
0.0010 ± 0.000
MITM ∗
0.6729 ± 0.275
0.6729 ± 0.275
0.6929 ± 0.294
0.0000 ± 0.000
0.0000 ± 0.000
0.0000 ± 0.000
TABLE III: Detection accuracy and Attack Success Rate (ASR) at minimum ( Δt=0.10 s) and maximum ( Δt=1.00 s) evaluated drift, across all fourteen categories. Values are mean ± std over 5 seeds.
Fig. 4: Accuracy and Attack Success Rate under PSA for the two categories exhibiting the strongest effects: ToN-IoT Ransomware (a, c) and DataSense DDoS (b, d), across four drift budgets. Error bars omitted for clarity; see Table III for standard deviations.
Fig. 5: Detector Evasion Rate (DER) against four synchronization-aware defenses under increasing drift (ToN-IoT Backdoor, the category with the most complete detector validation).
Category
PSA Queries
Query-Baseline Queries
Backdoor
0
29,120
DoS
0
21,930
DDoS
0
328,870
Scanning
0
2,030
MITM
0
10
Ransomware
0
15,360
TABLE IV: Model query cost: PSA vs. black-box query-based baseline (RF, ToN-IoT categories).
Fig. 6: (a) Physical Consistency Violation Rate (PCVR) for PSA across four representative categories, against the approximate range observed for unconstrained baseline attacks (shaded band). (b) Attacker query cost, PSA vs. query-based baseline, across seven ToN-IoT categories (log scale).
Work
Venue
Manipulated object
Interaction with detector
Additional requirement
Domain
Feature-space and query-driven evasion
Qiu et al. [ 24 ]
IEEE IoT-J 2021
Packet fields guided by salient features
Black-box access to train a shadow model
Shadow model, saliency map
IoT NIDS (Kitsune)
Yan et al. [ 25 ]
IEEE TDSC 2024
Traffic samples (morphing)
Label-only queries
Model extraction, transfer
Enterprise NIDS
Problem-space and traffic-space attacks
Han et al. [ 28 ]
IEEE JSAC 2021
Inter-arrival times, injected crafted packets
None (gray-box)
Known feature extractor, surrogate, GAN+PSO
Enterprise/IoT NIDS
Tan et al. [ 29 ]
IEEE TNSM 2022
Outbound live packets (atomic mutations)
Classifier outcome used as RL feedback †
Kalman feature predictor, SE-DQN agent
Enterprise NIDS
TABLE V: Comparison of representative adversarial attacks against learned intrusion and anomaly detectors, and of timing attacks on industrial infrastructure. “Interaction” is the access the adversary needs to the deployed detector at attack-construction time.