# Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems

arXiv: https://arxiv.org/abs/1911.04278 · HTML: https://mlsanity.com/paper/1911.04278/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 8 Nov 2019.

## Built on by (most cited first, 8 of 8)

- [Attack Rules: An Adversarial Approach to Generate Attacks for Industrial Control Systems using Machine Learning](https://mlsanity.com/paper/2107.05127/) (2021)
- [Adversarial Attacks and Defenses in Fault Detection and Diagnosis: A Comprehensive Benchmark on the Tennessee Eastman Process](https://mlsanity.com/paper/2403.13502/) (2024)
- [Adversarial Robustness of Deep State Space Models for Forecasting](https://mlsanity.com/paper/2604.03427/) (2026)
- [Attack Pattern Mining to Discover Hidden Threats to Industrial Control Systems](https://mlsanity.com/paper/2508.04561/) (2025)
- [Towards Trustworthy Wi-Fi CSI-based Sensing: Systematic Evaluation of Adversarial Robustness](https://mlsanity.com/paper/2511.20456/) (2025)
- [Robustness of Anomaly Detection Models for Industrial Control Systems under Training-Time Data Contamination](https://mlsanity.com/paper/2608.23547/) (2026)
- [Towards a Resilience-Theoretic Foundation for Adversarial Robustness in Industrial Control System Anomaly Detection](https://mlsanity.com/paper/2609.07244/) (2026)
- [Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection](https://mlsanity.com/paper/2610.02552/) (2026)

## Abstract (arXiv)

Neural networks are increasingly used for intrusion detection on industrial control systems (ICS). With neural networks being vulnerable to adversarial examples, attackers who wish to cause damage to an ICS can attempt to hide their attacks from detection by using adversarial example techniques. In this work we address the domain specific challenges of constructing such attacks against autoregressive based intrusion detection systems (IDS) in an ICS setting. We model an attacker that can compromise a subset of sensors in a ICS which has a LSTM based IDS. The attacker manipulates the data sent to the IDS, and seeks to hide the presence of real cyber-physical attacks occurring in the ICS. We evaluate our adversarial attack methodology on the Secure Water Treatment system when examining solely continuous data, and on data containing a mixture of discrete and continuous variables. In the continuous data domain our attack successfully hides the cyber-physical attacks requiring 2.87 out of 12 monitored sensors to be compromised on average. With both discrete and continuous data our attack required, on average, 3.74 out of 26 monitored sensors to be compromised.