Industrial iot intrusion detection vulnerable to timing shifts in data processing
Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection
Cryptography and SecurityArtificial Intelligence
Summary
Intrusion detection systems (IDS) protect industrial Internet of Things devices by watching for signs of attacks. The authors found that these systems rely on grouping data by time windows to understand what's happening. By slightly changing the timing of data packets, attackers can trick the IDS into seeing a fake state that hides real attacks. This new kind of attack doesn't need to change packet contents or repeatedly test the system, making it harder to detect and prevent. The authors tested this approach on popular datasets and several IDS models, showing it can reduce detection accuracy under certain conditions.
What this means in practice
- •For industrial network engineers: Detect and mitigate timing-based evasion tactics in industrial IoT intrusion detection pipelines by monitoring temporal data aggregation accuracy.
- •For cybersecurity operations teams: Improve incident response by recognizing stealthy disruptions in intrusion data caused by subtle timing shifts without packet alteration or queries.
Authors
Sabrine Ennaji, Elhadj Benkhelifa, Nadia Kabachi
Abstract
Machine learning-based intrusion detection systems (IDS) are critical for securing Industrial Internet of Things (IIoT) environments. Most adversarial research against them perturbs the feature vector or the traffic that produces it, and depends on gradient access, repeated model queries, or a learned model of benign traffic. A smaller line of work reshapes packet timing without querying the detector, but makes malicious traffic mimic a learned model of benign timing. Across these approaches, one assumption of industrial monitoring pipelines has received little attention: temporal synchronization. An IDS reconstructs operational state by aggregating telemetry into sliding or tumbling windows, so its view depends not only on what is observed but on when each observation falls relative to a window boundary. We introduce the Phantom State Attack (PSA), which exploits that dependence under a passive, zero-query threat model. Rather than modifying packets, perturbing features, querying the classifier, or fitting any model of benign traffic, PSA injects bounded timing drift calibrated to the attack flow's own inter-arrival variability, moving observations across the nearest window boundary by the minimal shift needed. The IDS then reconstructs a phantom state that diverges from the true process state. We evaluate PSA on ToN-IoT and CIC IIoT 2025 (DataSense), against Random Forest, MLP and XGBoost, measuring detection degradation, synchronization distortion, stealth, and attacker cost. PSA degrades detection on flows carrying enough packets for window-boundary redistribution, and leaves others almost unchanged, so its effect is conditional. A query-based baseline reaches higher raw success but needs many queries per window, while PSA needs none. The results identify temporal aggregation as an attack surface reachable under weaker assumptions than prior evasion techniques.