# Machine Learning for Cyber-Attack Identification from Traffic Flows

arXiv: https://arxiv.org/abs/2505.01489 · HTML: https://mlsanity.com/paper/2505.01489/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 24 references that are in the map.
- First posted on arXiv 2 May 2025.

## Builds on (most cited first, 5 of 5)

- ["Why Should I Trust You?": Explaining the Predictions of Any Classifier](https://mlsanity.com/paper/1602.04938/) (2016)
- [Visualizing and Understanding Convolutional Networks](https://mlsanity.com/paper/1311.2901/) (2013)
- [Deep Learning for Anomaly Detection: A Review](https://mlsanity.com/paper/2007.02500/) (2020)
- [Class-Incremental Learning for Wireless Device Identification in IoT](https://mlsanity.com/paper/2105.06381/) (2021)
- [Explainable AI for Comparative Analysis of Intrusion Detection Models](https://mlsanity.com/paper/2406.09684/) (2024)

## Abstract (arXiv)

This paper presents our simulation of cyber-attacks and detection strategies on the traffic control system in Daytona Beach, FL. using Raspberry Pi virtual machines and the OPNSense firewall, along with traffic dynamics from SUMO and exploitation via the Metasploit framework. We try to answer the research questions: are we able to identify cyber attacks by only analyzing traffic flow patterns. In this research, the cyber attacks are focused particularly when lights are randomly turned all green or red at busy intersections by adversarial attackers. Despite challenges stemming from imbalanced data and overlapping traffic patterns, our best model shows 85% accuracy when detecting intrusions purely using traffic flow statistics. Key indicators for successful detection included occupancy, jam length, and halting durations.