# TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack

arXiv: https://arxiv.org/abs/2103.06297 · HTML: https://mlsanity.com/paper/2103.06297/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 43 references that are in the map.
- First posted on arXiv 10 Mar 2021.

## Builds on (most cited first, 14 of 14)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Intriguing properties of neural networks](https://mlsanity.com/paper/1312.6199/) (2013)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Deep Anomaly Detection with Outlier Exposure](https://mlsanity.com/paper/1812.04606/) (2018)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [The Creation and Detection of Deepfakes: A Survey](https://mlsanity.com/paper/2004.11138/) (2020)
- [EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples](https://mlsanity.com/paper/1709.04114/) (2017)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [Adversarial Perturbations Fool Deepfake Detectors](https://mlsanity.com/paper/2003.10596/) (2020)
- [IDSGAN: Generative Adversarial Networks for Attack Generation against Intrusion Detection](https://mlsanity.com/paper/1809.02077/) (2018)
- [Adversarial Deep Learning for Robust Detection of Binary Encoded Malware](https://mlsanity.com/paper/1801.02950/) (2018)
- [Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors](https://mlsanity.com/paper/2005.07519/) (2020)
- [Rallying Adversarial Techniques against Deep Learning for Network Security](https://mlsanity.com/paper/1903.11688/) (2019)

## Built on by (most cited first, 12 of 12)

- [The Threat of Offensive AI to Organizations](https://mlsanity.com/paper/2106.15764/) (2021)
- [Adversarial Machine Learning In Network Intrusion Detection Domain: A Systematic Review](https://mlsanity.com/paper/2112.03315/) (2021)
- [FedDef: Defense Against Gradient Leakage in Federated Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.04052/) (2022)
- [Deep PackGen: A Deep Reinforcement Learning Framework for Adversarial Network Packet Generation](https://mlsanity.com/paper/2305.11039/) (2023)
- [Adversarial Machine Learning Threat Analysis and Remediation in Open Radio Access Network (O-RAN)](https://mlsanity.com/paper/2201.06093/) (2022)
- [Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis](https://mlsanity.com/paper/2606.04517/) (2026)
- [On Identifying Adversarial Intent Injection in AI-Native 6G Networks](https://mlsanity.com/paper/2609.12144/) (2026)
- [TEAM: Temporal Adversarial Examples Attack Model against Network Intrusion Detection System Applied to RNN](https://mlsanity.com/paper/2409.12472/) (2024)
- [Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS](https://mlsanity.com/paper/2506.20576/) (2025)
- [Uncovering and Understanding FPR Manipulation Attack in Industrial IoT Networks](https://mlsanity.com/paper/2601.14505/) (2026)
- [PLAA: Packet-level Adversarial Attacks in Network Traffic Detection](https://mlsanity.com/paper/2606.28439/) (2026)
- [Out of Sync, Out of Sight: Phantom State Attacks against IIoT Intrusion Detection](https://mlsanity.com/paper/2610.02552/) (2026)

## Abstract (arXiv)

Network intrusion attacks are a known threat. To detect such attacks, network intrusion detection systems (NIDSs) have been developed and deployed. These systems apply machine learning models to high-dimensional vectors of features extracted from network traffic to detect intrusions. Advances in NIDSs have made it challenging for attackers, who must execute attacks without being detected by these systems. Prior research on bypassing NIDSs has mainly focused on perturbing the features extracted from the attack traffic to fool the detection system, however, this may jeopardize the attack's functionality. In this work, we present TANTRA, a novel end-to-end Timing-based Adversarial Network Traffic Reshaping Attack that can bypass a variety of NIDSs. Our evasion attack utilizes a long short-term memory (LSTM) deep neural network (DNN) which is trained to learn the time differences between the target network's benign packets. The trained LSTM is used to set the time differences between the malicious traffic packets (attack), without changing their content, such that they will "behave" like benign network traffic and will not be detected as an intrusion. We evaluate TANTRA on eight common intrusion attacks and three state-of-the-art NIDS systems, achieving an average success rate of 99.99% in network intrusion detection system evasion. We also propose a novel mitigation technique to address this new evasion attack.