← Back to all news
arXiv AI By Sabrine Ennaji, Elhadj Benkhelifa, Nadia Kabachi

Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection

Read the original on arXiv AI →

The Flow has not summarised this story yet — read it at arXiv AI.

Related stories

arXiv Machine Learning
Sep 25

Unmasking Shortcut Learning in IoT Intrusion Detection: A Forensic, Multi-Paradigm Evaluation of Feature Dependence and Data Leakage

The paper investigates whether machine learning models for IoT intrusion detection truly learn attack patterns or rely on dataset shortcuts. Using the CyberFlowIoT-GICAP benchmark, the authors evaluate four learning paradigms across different feature sets and split strategies, finding that performance is largely driven by feature representation and that tree-based models can exploit temporal artifacts. The study also highlights asymmetric attack detectability and proposes a four-point protocol checklist for realistic evaluation.

By Uday Shankar Roy, Mahbuba Jahan Minu
benchmarks
More like this →
arXiv Machine Learning
Oct 8

Adversarial RL for Port-Scan Evasion: Attacker Feature Visibility in Edge-Deployed IDS

The paper studies how an adaptive attacker can evade machine‑learning intrusion detection systems (IDS) deployed on a Raspberry Pi 3B+ by using a Deep Q‑Network (DQN) to learn port‑scan tactics that vary probe timing, TCP flags, and payload size. Three IDS models—XGBoost, a multi‑layer perceptron, and a 1D convolutional neural network—trained on TON_IoT telemetry were evaluated under black‑box, gray‑box, and white‑box feature‑visibility scenarios. Evasion success rates ranged from 61.9 % to 98.3 %, showing that even limited feature knowledge can enable high‑rate evasion and that the impact of feature visibility depends on the specific IDS model.

By Logan Andrew North, Priya Sanjay Kaluskar, Shasi Kumar Ramachandran Prabhu, Peilong Li, Suman Saha
agentsreinforcement-learningsafety
More like this →