# PCAP-Backdoor: Backdoor Poisoning Generator for Network Traffic in CPS/IoT Environments

arXiv: https://arxiv.org/abs/2501.15563 · HTML: https://mlsanity.com/paper/2501.15563/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security.
- Builds on 12 of its 34 references that are in the map.
- First posted on arXiv 26 Jan 2025.

## Placed in

- LLM safety and security / [Backdoor and data poisoning attacks](https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/)

## Builds on (most cited first, 12 of 12)

- [Spectral Signatures in Backdoor Attacks](https://mlsanity.com/paper/1811.00636/) (2018)
- [Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering](https://mlsanity.com/paper/1811.03728/) (2018)
- [Invisible Backdoor Attack with Sample-Specific Triggers](https://mlsanity.com/paper/2012.03816/) (2020)
- [Input-Aware Dynamic Backdoor Attack](https://mlsanity.com/paper/2010.08138/) (2020)
- [Fooling automated surveillance cameras: adversarial patches to attack person detection](https://mlsanity.com/paper/1904.08653/) (2019)
- [A backdoor attack against LSTM-based text classification systems](https://mlsanity.com/paper/1905.12457/) (2019)
- [Adversarial Robustness Toolbox v1.0.0](https://mlsanity.com/paper/1807.01069/) (2018)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [Defending Neural Backdoors via Generative Distribution Modeling](https://mlsanity.com/paper/1910.04749/) (2019)
- [N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders](https://mlsanity.com/paper/1805.03409/) (2018)
- [Triggerless Backdoor Attack for NLP Tasks with Clean Labels](https://mlsanity.com/paper/2111.07970/) (2021)
- [Federated Intrusion Detection for IoT with Heterogeneous Cohort Privacy](https://mlsanity.com/paper/2101.09878/) (2021)

## Built on by (most cited first, 9 of 9)

- [Dynamic User-controllable Privacy-preserving Few-shot Sensing Framework](https://mlsanity.com/paper/2508.03989/) (2025)
- [Contrastive Continual Learning for Model Adaptability in Internet of Things](https://mlsanity.com/paper/2602.04881/) (2026)
- [Backdoor Attacks on Multi-modal Contrastive Learning](https://mlsanity.com/paper/2601.11006/) (2026)
- [Contrastive Learning for Privacy Enhancements in Industrial Internet of Things](https://mlsanity.com/paper/2602.00515/) (2026)
- [Backdoor Attacks on Contrastive Continual Learning for IoT Systems](https://mlsanity.com/paper/2602.13062/) (2026)
- [CFD-HAR: User-controllable Privacy through Conditional Feature Disentanglement](https://mlsanity.com/paper/2603.11526/) (2026)
- [Backdoor Attacks on Fault Detection and Localization in Cyber-Physical Systems](https://mlsanity.com/paper/2605.27674/) (2026)
- [Continual Backdoor Training in IoT/CPS](https://mlsanity.com/paper/2606.14987/) (2026)
- [CLIP-guided Diffusion Model for Backdoor Generation in Sensor-based Human Activity Recognition](https://mlsanity.com/paper/2606.22837/) (2026)

## Abstract (arXiv)

The rapid expansion of connected devices has made them prime targets for cyberattacks. To address these threats, deep learning-based, data-driven intrusion detection systems (IDS) have emerged as powerful tools for detecting and mitigating such attacks. These IDSs analyze network traffic to identify unusual patterns and anomalies that may indicate potential security breaches. However, prior research has shown that deep learning models are vulnerable to backdoor attacks, where attackers inject triggers into the model to manipulate its behavior and cause misclassifications of network traffic. In this paper, we explore the susceptibility of deep learning-based IDS systems to backdoor attacks in the context of network traffic analysis. We introduce textttPCAP-Backdoor, a novel technique that facilitates backdoor poisoning attacks on PCAP datasets. Our experiments on real-world Cyber-Physical Systems (CPS) and Internet of Things (IoT) network traffic datasets demonstrate that attackers can effectively backdoor a model by poisoning as little as 1% or less of the entire training dataset. Moreover, we show that an attacker can introduce a trigger into benign traffic during model training yet cause the backdoored model to misclassify malicious traffic when the trigger is present. Finally, we highlight the difficulty of detecting this trigger-based backdoor, even when using existing backdoor defense techniques.