PaperlayerView exact revision on arXiv

Source-linked AI summary

Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection

Sabrine Ennaji, Elhadj Benkhelifa, Nadia Kabachi

arXiv:2610.02552v1cs.CRcs.AI

TL;DR

Window-based IDS depend on when telemetry falls relative to aggregation boundaries, a temporal-synchronization vulnerability that has received little attention. The paper introduces PSA, which shifts attack-flow timing without detector queries or a benign-traffic model. Across two datasets, detection degradation is conditional on flow characteristics, while a query-based baseline achieves higher raw success at substantial query cost.

  • Problem

    Prior IDS evasion mainly manipulates packets or features and relies on gradients, queries, or learned traffic models, while temporal placement within aggregation windows remains underexplored.

    Source: §I · pp. 1–2

  • Method

    PSA uses bounded timing drift calibrated to an attack flow’s own inter-arrival variability to shift observations across window boundaries without querying the IDS or modeling benign traffic.

    Source: §I · p. 2

  • Results

    PSA degrades detection on categories whose flows span enough windows for boundary redistribution, leaves other categories almost unchanged, and requires no model interaction while a query-based baseline can achieve higher raw success.

    Source: E. Discussion · p. 12, §VI · p. 14

  • Takeaways & Limitations

    Temporal aggregation is an attack surface reachable under a weaker threat model than feature-space evasion, without detector queries or a model of benign traffic.

    Source: E. Discussion · p. 12, §VI · p. 14

    PSA’s detection degradation is conditional on target flows spanning enough windows for boundary redistribution; remaining categories are essentially unchanged.

    Source: §VI · p. 14

Abstract

from arXiv · show

Machine learning-based intrusion detection systems (IDS) are critical for securing Industrial Internet of Things (IIoT) environments. Most adversarial research against them perturbs the feature vector or the traffic that produces it, and depends on gradient access, repeated model queries, or a learned model of benign traffic. A smaller line of work reshapes packet timing without querying the detector, but makes malicious traffic mimic a learned model of benign timing. Across these approaches, one assumption of industrial monitoring pipelines has received little attention: temporal synchronization. An IDS reconstructs operational state by aggregating telemetry into sliding or tumbling windows, so its view depends not only on what is observed but on when each observation falls relative to a window boundary. We introduce the Phantom State Attack (PSA), which exploits that dependence under a passive, zero-query threat model. Rather than modifying packets, perturbing features, querying the classifier, or fitting any model of benign traffic, PSA injects bounded timing drift calibrated to the attack flow's own inter-arrival variability, moving observations across the nearest window boundary by the minimal shift needed. The IDS then reconstructs a phantom state that diverges from the true process state. We evaluate PSA on ToN-IoT and CIC IIoT 2025 (DataSense), against Random Forest, MLP and XGBoost, measuring detection degradation, synchronization distortion, stealth, and attacker cost. PSA degrades detection on flows carrying enough packets for window-boundary redistribution, and leaves others almost unchanged, so its effect is conditional. A query-based baseline reaches higher raw success but needs many queries per window, while PSA needs none. The results identify temporal aggregation as an attack surface reachable under weaker assumptions than prior evasion techniques.

I. INTRODUCTION

Prior IDS evasion often manipulates features or packet contents and relies on gradients, queries, or learned traffic models, while windowed monitoring also depends on temporal placement. The paper introduces PSA to exploit that dependency without detector queries or benign-traffic models, with effects that depend on target-flow characteristics.

I. INTRODUCTION

  • Most prior IDS attacks perturb packet contents, protocol fields, or features and require gradients, repeated classifier queries, or a learned victim-traffic model.Timing-only prior work avoids queries but learns benign inter-packet delays and retimes attacks to mimic them.Source: §I · p. 1
  • Windowed IDS features depend on when observations fall relative to boundaries, but temporal synchronization has received little attention as an attack surface.Window aggregation changes which observations contribute to extracted statistical features and the state reconstructed by the IDS.Source: §I · p. 1
  • PSA injects bounded drift calibrated to a flow’s own inter-arrival variability, shifting observations across the nearest window boundary without modifying packets or querying the classifier.The resulting phantom state diverges from the true monitored-process state.Source: §I · p. 2
  • Across learning paradigms and two industrial datasets, PSA degrades detection only on flows with enough packets for boundary redistribution; other target-flow categories are nearly unchanged.The evaluation spans ToN-IoT and CIC IIoT 2025 (DataSense), using RF, MLP, and XGBoost.Source: §I · p. 2
  • A query-based baseline reaches higher raw success, whereas PSA requires no queries; the paper compares their attacker costs and traffic consistency.The evaluation also assesses stealth against four synchronization-aware detectors.Source: §I · p. 2

II. BACKGROUND AND TECHNICAL FOUNDATIONS

The background describes how IIoT IDS transform telemetry into features and decisions, and how temporal windows let monitoring systems reconstruct process behavior. This dependence on window composition makes timing part of the IDS input.

A. ML-Based Intrusion Detection in IIoT Environments

B. Temporal Feature Reconstruction in Industrial Monitoring Systems

  • Industrial monitoring pipelines aggregate observations into windows before feature extraction, capturing rates, bursts, timing, and protocol activity that packet-level analysis may miss.The window contains observations occurring during its duration, and the feature process transforms them into statistical and temporal features.Source: B. Temporal Feature Reconstruction in… · p. 3
  • Under synchronized operation, the IDS-reconstructed state accurately reflects the underlying process, and temporal aggregation supports reconstruction from continuous telemetry.The pipeline derives its operational view from the observed telemetry stream.Source: B. Temporal Feature Reconstruction in… · p. 3

C. Temporal Desynchronization as an Adversarial Attack Surface

Temporal aggregation makes feature representations depend on which observations fall within each window, so timing changes can affect the IDS view without changing communication content. The paper frames the resulting divergence from process state as the basis of PSA.

C. Temporal Desynchronization as an Adversarial Attack Surface

  • Most adversarial IDS work manipulates packet attributes, payloads, or extracted features, while temporal consistency in window-based feature extraction has received comparatively little attention.Changes in observation timing may alter the information supplied to the classifier.Source: C. Temporal Desynchronization as an… · p. 3
  • Carefully controlled timing variations can redistribute protocol-valid, operationally plausible observations across adjacent windows without changing packet content.The resulting feature representations can differ from those produced under synchronized conditions.Source: C. Temporal Desynchronization as an… · pp. 3–4
  • Temporal desynchronization can make the IDS’s reconstructed operational representation diverge from the monitored process, forming the basis of PSA.The broader vulnerability includes multiple independently timed telemetry sources, but this work evaluates timing perturbations within a single flow against a fixed window boundary.Source: C. Temporal Desynchronization as an… · p. 4

III. PHANTOM STATE ATTACK METHODOLOGY

The methodology presents PSA as a zero-query attack that exploits synchronization dependencies in industrial monitoring. It evaluates the attack against several IDS model families under a defined IIoT monitoring threat model.

III. PHANTOM STATE ATTACK METHODOLOGY

  • The methodology defines PSA and its evaluation of effectiveness, stealth, and operational feasibility under a passive, zero-query black-box setting.The attack uses flow-calibrated temporal desynchronization to exploit synchronization dependencies in monitoring pipelines.Source: §III · p. 4
  • PSA perturbs timing only, requires no detector interaction, and fits neither a surrogate model nor a model of benign traffic.The attack uses timing observed from its own attack flow; query-based methods use an oracle, while other query-free timing attacks model benign timing.Source: §III · p. 4

A. Threat Model and Attack Assumptions

  • The attacker targets an IIoT IDS monitoring industrial communication and classifying operational behavior as benign or malicious.The evaluation uses RF, MLP, and XGBoost to examine generalization across learning paradigms.Source: 1) Target Environment · pp. 4–5

2) Attacker Capabilities and Assumptions:

PSA assumes an attacker can schedule and observe the timing of its own flow, without access to the IDS or queries, and approximately infer its aggregation parameters. It uses bounded, flow-calibrated shifts to move eligible packets across nearby window boundaries, changing the IDS’s reconstructed state while preserving packet contents and order.

2) Attacker Capabilities and Assumptions:

  • PSA requires no model, feature, training-data, gradient, or decision access and submits no queries to the IDS.The attacker passively observes and controls the timing of its own attack flow; packets may be advanced or delayed in the primary variant.Source: 2) Attacker Capabilities and Assumptions · p. 5
  • The attacker estimates the aggregation window duration and origin from observed traffic periodicity, but the parameters need not be known exactly.The evaluation tests sensitivity to an assumed wrong duration and shifted origin.Source: 2) Attacker Capabilities and Assumptions · p. 5

B. Phantom State Attack Framework

  • PSA observes timing, selects flows with sufficient packet volume and inter-arrival regularity, then applies minimal boundary-crossing drift within each flow’s timing budget.Packets that cannot cross a boundary within the budget remain unmodified; shifted packets are reassigned to adjacent windows without changing contents or flow order.Source: B. Phantom State Attack Framework · pp. 5–6
  • The per-flow drift budget is the tighter of the flow’s inter-arrival-time standard deviation and the global cap, so low-variability flows may receive little or no drift.Bounded jitter may be added after the minimum boundary-crossing shift, within the remaining plausible timing budget.Source: B. Phantom State Attack Framework · p. 5
  • Redistributing packets changes window features and can produce the distorted operational perception termed a phantom state.The workflow re-derives window assignments after timestamps change.Source: B. Phantom State Attack Framework · p. 6

C. Operational Feasibility and Experimental Setup

The evaluation tests whether flow-calibrated timing changes can affect detection while retaining realistic communication behavior, using two industrial datasets with different capture conditions. Together, they span fourteen attack categories, with two ToN-IoT categories excluded because too few flows met the targeting threshold.

1) Experimental Datasets:

  • The evaluation uses ToN-IoT and CIC IIoT Dataset 2025 (DataSense), spanning fourteen attack categories across two industrial datasets.DataSense provides an independent, heterogeneous 40-device testbed with generally shorter, single-session captures than ToN-IoT.Source: 1) Experimental Datasets · p. 6
  • ToN-IoT provides packet captures and timestamped Zeek flow records, while DataSense supplies synchronized sensor and network streams from a separate testbed.These data characteristics support timing analysis and comparison across different capture conditions.Source: 1) Experimental Datasets · p. 6
  • Two ToN-IoT categories, XSS and injection, were excluded because too few flows met the minimum packet-volume threshold for reliable PSA targeting.The evaluation’s objective is to assess detection effects, operational realism, and attacker-capability trade-offs.Source: 1) Experimental Datasets · p. 6, C. Operational Feasibility and… · p. 6

2) Feature Pipeline:

The pipeline builds tumbling-window features from packet-level traffic and tests PSA across drift budgets and controlled attack variants. Evaluation criteria cover detection, redistribution, stealth, and attacker cost, including checks against synchronization-aware detectors and physical consistency.

2) Feature Pipeline:

  • Features are recomputed from packet-level traffic in 2 s tumbling windows anchored at the capture origin, rather than by editing pre-aggregated flow records.The five features are packet count, total bytes, window duration, and mean and standard deviation of inter-arrival time; emptied windows produce no record.Source: 2) Feature Pipeline · p. 6
  • Test flows are split from training at the flow level, and PSA targets only test flows with at least three packets; models are repeated over five seeds.Random Forest, MLP, and XGBoost are trained on clean training windows.Source: 2) Feature Pipeline · p. 6

3) Experimental Scenarios:

  • PSA is tested at global drift caps of 0.10, 0.25, 0.50, and 1.00 s, with larger caps allowing more packets and flows to cross window boundaries.The actual per-flow budget is limited by the tighter of the global cap and that flow’s inter-arrival variability.Source: 3) Experimental Scenarios · p. 6
  • Controlled variants test delay-only shifts, uniform random drift, incorrect aggregation parameters, and attack success both including and excluding emptied windows.A magnitude-matched feature-noise baseline and a greedy query-based baseline provide comparisons of attacker cost and traffic realism.Source: 3) Experimental Scenarios · p. 7

4) Evaluation Criteria:

  • Evaluation measures detection metrics and attack success alongside packet redistribution, stealth, physical consistency, and model query count.Stealth includes detector evasion against four per-flow synchronization-aware detectors and a population-level inter-arrival detector, plus arithmetic plausibility of packet count, duration, and inter-arrival statistics.Source: 4) Evaluation Criteria · p. 8

IV. RESULTS AND DISCUSSION

Across fourteen attack categories on ToN-IoT and DataSense, PSA’s effect on detection varies substantially by category. Packet redistribution rises with drift budget, but does not always change surviving-window decisions.

A. Impact of PSA on Detection Performance and Attack Success

  • MLP records the highest ASR more often among categories with measurable effects, but the architecture ranking is suggestive rather than established.Lower clean accuracy on some categories and differences smaller than one standard deviation across seeds qualify the comparison.Source: A. Impact of PSA on Detection… · p. 8
  • PSA’s effects vary by category: ToN-IoT DoS, DDoS, scanning, and password show near-zero ASR, while Ransomware has the dataset’s strongest effect.Window-boundary redistribution can change features only when a flow spans multiple windows and packets sit near a boundary; the effect is therefore conditional, not uniform.Source: A. Impact of PSA on Detection… · pp. 8–9

IV. RESULTS AND DISCUSSION

  • The evaluation reports accuracy and ASR at minimum and maximum drift budgets across fourteen categories, using means and standard deviations over five seeds.ToN-IoT XSS and injection were excluded because too few flows met the minimum packet threshold for reliable targeting.Source: A. Impact of PSA on Detection… · p. 8, Table III · p. 9

B. Synchronization Distortion (Packet Redistribution Ratio)

  • Mean Packet Redistribution Ratio rises from 8.7% at ∆max=0.10s to 78.4% at ∆max=1.00s, with category-level values ranging from 3.3% to 99.4%.Redistribution also increases in near-null categories, where changed features are not always sufficient to flip a surviving window’s decision.Source: B. Synchronization Distortion (Packet… · p. 9

A. Impact of PSA on Detection Performance and Attack Success

  • MLP accuracy on ToN-IoT Ransomware falls from 76.6% to 49.3% as drift budget rises from 0.10s to 1.00s, with ASR reaching 40.7%.On DataSense DDoS, all three architectures degrade and MLP ASR reaches 96.3%; these low-rate attacks depend on windows spanned and packet positions near boundaries, and emptied windows contribute to measured success.Source: A. Impact of PSA on Detection… · p. 8, Figure 4 · p. 10

C. Stealth Against Synchronization-Aware Detectors

PSA's stealth varies with drift: it evades some synchronization-aware defenses more readily than clock-drift detection. Against baselines, its zero-query operation trades lower raw success for conditional physical realism.

C. Stealth Against Synchronization-Aware Detectors

  • Clock-drift detection’s DER falls from 92.2% at ∆max=0.10s to 34.3% at ∆max=1.00s, while the composite evasion rate falls from 83.6% to 34.0%.The IAT monitor and window-consistency checker remain largely ineffective, with DER above 91% throughout; IAT evasion is partly structural because PSA respects the monitor’s per-flow variance threshold.Source: C. Stealth Against… · p. 10, Figure 5 · p. 11

D. Comparison Against Baseline Attacks: Attacker Cost and Physical Realism

  • On ToN-IoT Backdoor, the query-based baseline reaches substantially higher ASR than PSA at every tested drift level, but searches a less physically constrained perturbation space.The comparison uses feature perturbation for the baseline and packet timing for PSA.Source: D. Comparison Against Baseline… · p. 11
  • Across seven ToN-IoT categories, PSA uses zero model queries, while the query-based baseline uses 101 to 3.3 × 10^5 total queries, depending on category.The baseline was run on RF and one seed; MITM needed about ten queries, so the cost gap varies by category.Source: D. Comparison Against Baseline… · p. 11, Table IV · p. 11
  • For ToN-IoT Backdoor and Ransomware, PSA’s PCVR is 2.6% to 15.1% and 7.5% to 47.7%, respectively, below the baseline range of roughly 44% to 67%.The advantage narrows in shorter, denser DataSense captures and approaches or exceeds the baseline range in several categories.Source: D. Comparison Against Baseline… · pp. 11–12, Figure 6 · p. 12

E. Discussion

The discussion frames PSA as a conditional, zero-query attack rather than a universally stronger evasion method. It also places prior adversarial work along the axes of what is manipulated and what detector access is required.

E. Discussion

  • PSA degrades detection only in categories where flows span enough windows for boundary redistribution; other categories remain almost unchanged, and the attack uses no model of benign traffic or interaction with the deployed model.Where effects occur, MLP tends to be most affected, but lower clean accuracy explains part of the gap and some category differences fall within seed noise.Source: E. Discussion · p. 12
  • PSA evades per-flow variance monitors calibrated to its drift bound, but population-level distribution tests and clock-drift detection catch it more often as drift grows.This is a stealth-effectiveness trade-off, not unconditional stealth.Source: E. Discussion · p. 12
  • A query-based baseline reaches higher ASR but needs up to hundreds of thousands of total model queries, whereas PSA needs none.The gap is smaller in categories where the baseline needs only a few queries.Source: E. Discussion · p. 12
  • PSA’s traffic-realism advantage over unconstrained baselines holds for long, well-spaced flows and narrows for short, dense flows.Source: E. Discussion · p. 12

V. RELATED WORK

  • Prior adversarial work can be compared by its manipulated object—features, traffic, or process values—and its required interaction with the deployed detector.The paper uses these two axes to position representative works and distinguish PSA.Source: §V · pp. 12–13

A. Feature-Space and Query-Driven Evasion

Prior IDS evasion work varies in both what it manipulates and what access it requires, while traffic-space approaches add constraints of plausibility and operational execution. Timing-based work establishes timing as an attack vector, but PSA targets windowed IDS aggregation rather than benign-timing mimicry or process values.

A. Feature-Space and Query-Driven Evasion

  • Feature-space attacks manipulate extracted features, and many rely on gradients, repeated detector queries, or surrogate models; query-based variants replace some knowledge requirements with interaction.Prior analyses note that feature-vector success alone says little about what an attacker can achieve on the wire.Source: A. Feature-Space and Query-Driven… · p. 13

B. Problem-Space and Traffic-Space Attacks

  • Problem-space attacks must preserve semantics and plausibility, while several traffic-space methods use learned surrogates or benign-traffic models and require representative training data.The cited approaches include packet mutation, reinforcement learning, generative traffic blending, and feature selection under traffic constraints.Source: B. Problem-Space and Traffic-Space… · p. 13

C. Timing-Based Traffic Reshaping

  • TANTRA demonstrates timing-only evasion without NIDS access, but learns benign inter-packet delays and replaces the attack’s timing process; PSA instead uses bounded flow-calibrated shifts across aggregation-window boundaries.PSA exploits window discretization to make the IDS-reconstructed state diverge from the process state, rather than mimicking benign timing.Source: C. Timing-Based Traffic Reshaping · pp. 13–14

D. Evasion in Industrial Control and Cyber-Physical Monitoring

  • Industrial process-concealment attacks rewrite sensor or process values, whereas PSA changes when network observations arrive and leaves their values intact.The cited process-level methods assume control over field-device reports.Source: D. Evasion in Industrial Control and… · p. 14

E. Timing and Synchronisation Attacks on Industrial Infrastructure

  • Prior timing attacks affect clocks, synchronization protocols, or sensor fusion, but do not examine ML-based IDS windowed aggregation as the route by which desynchronization alters detection.Source: E. Timing and Synchronisation Attacks… · p. 14

F. Positioning of PSA

PSA combines timing-only perturbation with a passive, zero-query threat model, but its effects depend on flow and monitoring conditions. The paper positions temporal aggregation as an underexplored attack surface and identifies further settings for evaluation.

F. Positioning of PSA

  • PSA combines timing-only, flow-bounded drift with no detector interaction or trained benign-traffic model, at the cost of lower raw attack success than query-driven attacks.The attack attributes evasion to the interaction between drift and aggregation windows.Source: F. Positioning of PSA · p. 14

VI. CONCLUSION AND FUTURE SCOPE

  • Detection degradation was conditional: it affected categories with enough windows for boundary redistribution and left the remaining categories essentially unchanged.The comparison found that a query-based baseline could achieve higher raw success but required many model interactions, whereas PSA required none.Source: §VI · p. 14
  • PSA's stealth and traffic realism were not unconditional: population-level distribution and clock-drift tests caught it more often as drift grew, while realism was weaker in short, dense flows.It evaded per-flow variance monitors calibrated to the same quantity it stayed under; its realism advantage over unconstrained baselines was strongest in long, well-spaced flows.Source: §VI · p. 14
  • The results identify temporal aggregation as an underexplored attack surface in ML-based IDS, reachable under a weaker threat model than feature-space evasion.Future work includes cross-sensor desynchronization, which would perturb relative timing across multiple telemetry sources rather than within a single flow.Source: §VI · p. 14

IIoT NIDS

  • Open directions include characterizing traffic conditions where PSA applies, testing synchronization-aware defenses, and evaluating additional protocols and larger deployments.Clock-drift detection and population-level distribution tests proved more effective against PSA than per-flow variance monitoring.Source: IIoT NIDS · p. 15
Loading 2610.02552v1…