Pith. sign in

REVIEW 4 major objections 5 minor 35 references

PCAP-Backdoor: Backdoor Poisoning Generator for Network Traffic in CPS/IoT Environments

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that an attacker with no access to the feature extractor can backdoor a deep-learning network intrusion detector by injecting crafted TCP packets into raw PCAP training data, with as little as 1% or less of the training…

desk verdict A useful backdoor attack paper with a genuine raw-packet trigger, let down by an overbroad feature-extraction claim and a missing 1% result. read the letter →

arxiv 2501.15563 v2 pith:EW6KAWAN submitted 2025-01-26 cs.LG cs.CRcs.NI

Ajesh Koyatan Chathoth , Stephen Lee This is my paper · ORCID
classification cs.LGcs.CRcs.NI
keywords backdoorattackdatapoisoningintrusiondetectionnetworktrafficPCAPCPS/IoTclean-labelactivationclustering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a deep-learning intrusion detection system (IDS) for CPS/IoT networks can be backdoored by an attacker who never sees the model or its feature extractor. Instead of perturbing extracted features, the attacker injects crafted TCP packets into raw packet-capture (PCAP) training data that the victim will use; those packets shift flow statistics that the feature extractor computes, so the model learns a trigger that later makes attack traffic look benign. The authors report that poisoning as little as 1% or less of the training dataset, using only benign-labeled traffic from a single device, is enough, and that the standard activation-clustering defense fails to expose the backdoor. A sympathetic reader would care because this makes backdoor attacks realistic against data-driven IDS that train on public or third-party packet captures.

What carries the argument

The load-bearing object is the backdoor trigger: a short burst of crafted TCP packets injected into raw packet captures before feature extraction. The injection algorithm selects benign packets by ratio $R$, checks whether a bidirectional counterpart exists within a time window $BT$, and for bidirectional flows emits a matched pair, one packet with the SYN flag and a random sequence number, the other with the RST flag and sequence number plus one, source and destination IPs swapped, both padded or trimmed to a fixed length $L$ and timestamped $D$ apart. For unidirectional flows it emits up to $\min(B, \lfloor t_d/D \rfloor)$ packets with the same source IP and an arbitrary destination IP. The crafted packets are arranged to avoid common Wireshark TCP warnings (spurious retransmission, ACKed unseen segment, port reuse, out-of-order), and their effect is indirect: they change the count, size, jitter, and socket statistics that a flow-based feature extractor (e.g., the 115-feature extractor from [15]) computes. The model trained on the poisoned capture therefore learns the burst signature as a benign-class pattern, and the same burst replayed on attack traffic during inference triggers the misclassification.

What would settle it

Run the same poisoned capture through a sanitizer that discards TCP packets not belonging to an established or completed session before feature extraction, then retrain the IDS. If the attack success rate drops to near zero, the trigger's mechanism is confirmed to be the injected packets' effect on flow statistics; if the ASR stays high, the backdoor survives such preprocessing and the stated mechanism is incomplete.

Watch

Extended reading notes

Core claim

The paper's central claim is that an attacker who controls only benign-labeled raw packets from a single device can plant a backdoor in a deep-learning network intrusion detector without touching the model, its training procedure, or the feature extractor; the only additional knowledge assumed is which flow features the victim uses. The trigger is a burst of crafted TCP packets, a SYN packet paired with an RST response, with sequence numbers, IPs, timestamps, and payload lengths designed to look normal to Wireshark-style TCP analysis, inserted into the benign capture before feature extraction. Because flow statistics such as packet counts, sizes, and jitter are derived from raw packets, the burst shifts those statistics. During training the model sees only poisoned benign samples labeled benign; during inference, replaying the same burst on attack traffic makes the model classify the attack as benign. The paper reports this works with as little as 1% or less of the training set poisoned, across binary and multi-class IDS models, DNN and CNN architectures, and several feature sets, and that activation clustering does not separate poisoned from clean samples.

Load-bearing premise

The attack assumes the victim's preprocessing pipeline passes the attacker-supplied raw packet capture straight into a feature extractor, so that the injected TCP control packets change the flow statistics the model sees; if the pipeline filters unexpected flows, re-captures traffic, or uses features insensitive to packet count and timing, the trigger is removed and the attack fails.

Editorial extensions

If this is right

  • Public and third-party PCAP datasets are a viable poisoning vector for deep-learning IDS even when the attacker controls only benign traffic from one device.
  • Clean-label data alone can carry a backdoor: label integrity checks do not prevent this attack.
  • The backdoor transfers across model architectures (DNN-3, DNN-5, CNN-2, CNN-5) and across several flow-feature sets, so choosing a different model does not by itself neutralize it.
  • Activation-based clustering is not a reliable defense for this trigger: silhouette scores do not peak at two clusters, and trigger samples are spread across clusters.
  • The poisoning fraction required is far smaller than label-flipping baselines (e.g., 2% versus 35–80% for several attack types in the paper's Table I).

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because the trigger works through flow statistics, a preprocessing pipeline that drops packets outside established TCP sessions or recomputes flows with short timeouts should remove the trigger; this is testable without changing the model.
  • Editorial inference: the same raw-packet injection idea should carry over to UDP and ICMP flows and to feature extractors beyond the four settings evaluated, since it only assumes the extractor consumes packet-level statistics.
  • Editorial inference: the paper tests only activation clustering; other defenses such as spectral signatures, trigger inversion, or input filtering may detect or suppress the backdoor, so the stealth claim is scoped to activation clustering.
  • Editorial inference: the paper reports single training runs; whether the backdoor persists through retraining, fine-tuning, or federated averaging is untested.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces PCAP-Backdoor, a clean-label backdoor attack on deep-learning network intrusion detection systems. The attacker contributes only benign-labeled PCAP traffic from a single device, injects crafted TCP SYN/RST packet bursts into the raw packets before feature extraction, and the victim's model is expected to learn to classify triggered attack traffic as benign. The method is evaluated on a CPS SCADA dataset and the UCI IoT botnet dataset using Kitsune-style per-packet features, binary and multi-class DNN/CNN classifiers, several feature subsets, and activation-clustering as a defense. The paper claims that the attack succeeds with 1% or less poisoned data, that it transfers across attack types and model architectures, and that activation clustering cannot detect the trigger.

Significance. If the central claims are supported, this is a useful demonstration that backdoor poisoning can be carried out at the raw-packet layer rather than in feature space, which is a meaningful practical distinction for the data-supply-chain threat model. The paper has several genuine strengths: it uses real-world CPS/IoT datasets, evaluates a clean-label and black-box setting, validates injected packets against Wireshark TCP heuristics, compares against a label-flipping baseline, and probes multiple architectures and feature subsets. However, the quantitative headline claims are currently overextended relative to the reported data, the feature-extractor dependence is under-tested, and the activation-clustering evaluation deviates from the standard protocol. The work is a reasonable starting point for a revised paper, but the current manuscript does not yet support its strongest advertised conclusions.

major comments (4)
  1. [Abstract, Section V.A, Table I, Section IX] The claim that the attack requires '1% or less' poisoned data is not supported by the reported experiments. Table I reports Data modified (%) = 2 for every PCAP-Backdoor row, and Section V.A explicitly states that a 0.97 ASR is achieved 'by poisoning only 2% of the training dataset.' Section V.C sweeps backdoor percentages from 0.5% to 10%, but the paper never isolates the 1% level or reports the ASR at that level for any attack type. The abstract and conclusion should either present actual 1%-and-below results or be revised to state the lowest tested poisoning percentage that is supported by the data.
  2. [Section II.C, Section V.E, Algorithms 1-2] The attack is evaluated only against Kitsune-style feature extractors that consume every packet as part of per-packet statistics (all 115 features, jitter, packet-size, and socket-based subsets). All these extractors process every raw packet, including the injected SYN/RST bursts. The manuscript does not test a flow-based parser, such as CICFlowMeter-style processing, which reconstructs bidirectional TCP flows and typically discards or isolates incomplete handshakes. Under such an extractor, an injected SYN to an arbitrary destination would form a separate one-packet flow or be dropped, so the trigger would not appear in the features used for inference and the backdoor would not fire. The threat model in Section II.C says the attacker knows which features are used, but it explicitly denies access to the feature extraction step itself. To support the general claim that raw-PCAP injection is sufficient, the authors should either evaluate against a flow-based feature extractor or explicitly narrow the threat model and the resulting claims to the class of per-packet statistical feature extractors.
  3. [Section VI.A, Figure 12, Table II] The activation-clustering defense evaluation does not follow the standard activation-clustering protocol. The authors apply t-SNE to the hidden-layer activations and then run K-Means on the t-SNE embedding, whereas the method in [22] clusters the activations directly; t-SNE is a stochastic, nonlinear embedding that can create or destroy cluster structure and is not a reliable preprocessing step for clustering-based detection. In addition, the Silhouette-score comparison is not a valid standalone test of backdoor detection: a score of 0.62 for cluster size 2 is not shown to be low in any absolute or relative sense, no comparison is made against a clean model trained without backdoors, and all numbers appear to come from a single run. To support the claim that activation clustering fails to detect this backdoor, the authors should run the original clustering pipeline on raw activations, compare against a clean-model baseline, and report detection-oriented metrics with multiple runs.
  4. [Section V, all result tables and figures] The paper reports no error bars, confidence intervals, or multiple-seed runs for any ASR, confusion matrix, or Silhouette score. The attack itself is randomized (Algorithm 1 samples a uniform variable for each packet), and the models use randomized initialization, so the reported differences, for example Mirai ASR of 0.39 versus 0.82 in Figure 5 or the exact Silhouette ordering in Table II, could easily be within run-to-run variation. The authors should repeat the headline experiments several times and report the mean and standard deviation or confidence intervals for at least the results in Table I and Section VI.
minor comments (5)
  1. [Index Terms] The index terms 'federated learning, differential privacy, continual learning' do not correspond to the content of this paper; they should be replaced with terms such as network intrusion detection, backdoor attack, data poisoning, and IoT security.
  2. [Algorithm 1] The look-ahead in ISBD(i) implicitly assumes that a next packet p_{i+1} always exists; the boundary case where the current packet is the last one in P should be handled or stated explicitly.
  3. [Section IV.C] The statement that 'The code will be made available for artifact evaluation' should include a repository link or a clear availability statement; without the code or detailed hyperparameters, the reproducibility of the numbers in Table I is hard to assess.
  4. [Figure 5] The box plots presumably aggregate across devices or runs, but the text does not specify how many devices, runs, or trials underlie each box. Please clarify the construction of the boxes and the number of repetitions used.
  5. [Section VI.A] The sentence 'Silhouette score close to 1 indicates the optimal number of clusters' is imprecise; the Silhouette score measures cluster cohesion and separation, and its maximum over k is only a heuristic for choosing k, not a direct measure of backdoor detectability.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: attack success is measured on held-out trigger data with non-forced failures; the paper's self-citations are contextual and non-load-bearing.

full rationale

PCAP-Backdoor is an empirical attack-and-evaluation paper containing no derivation whose output equals its input by construction. The attack pipeline (Algorithms 1-2 craft SYN/RST bursts with control parameters B, D, R, L; the victim's feature extractor, Kitsune [15], computes 115 flow statistics that absorb the injected packets; the classifier is trained on trigger-bearing benign samples) is a causal chain, not an identity. ASR is measured on held-out trigger data generated by the same algorithm used for poisoning, which is the standard backdoor evaluation paradigm; the measurement is not a tautology because the same protocol yields non-forced failures (e.g., Mirai ASR 0.39 at 2% poisoning in Table I, and ASR varying with trigger count in Figure 11). The paper's self-citations ([16], [17], [25]) are contextual background and related-work references, none load-bearing; no uniqueness theorem, ansatz, or fitted parameter is imported from the authors' prior work. The abstract's '1% or less' claim is inconsistent with Table I's 2% entries, and the attack's reliance on a feature extractor that consumes incomplete SYN/RST flows is a threat-model limitation, but both are correctness/robustness concerns, not circularity. The undetectability claim is tested against an external defense (activation clustering, [22]) on external datasets with an external feature extractor, so it is a falsifiable empirical result. Score 2 reflects the presence of minor, non-load-bearing self-citations only.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The attack is empirical and rests on assumptions about how the victim processes data. The free parameters are attacker-chosen trigger controls, not model parameters fitted to scientific data. No new physical entities are introduced.

free parameters (6)
  • B (trigger packet count) = 3, 5, 8
    Attacker-chosen parameter controlling the number of injected packets; ASR increases with B, so results depend on this tuning.
  • D (time delay between trigger packets) = not given as default; Mirai-fast uses D reduced to one-tenth
    Affects ASR and is tuned per attack dataset to improve performance.
  • R (backdoor injection packet selection ratio) = 0.2
    Determines the proportion of packets that receive triggers; chosen by hand in Section IV-C.
  • L (trigger payload length) = not specified numerically
    Attacker-chosen packet size parameter; the paper shows packet-size features are especially susceptible.
  • Fixed destination IP and MAC = chosen by attacker
    Part of the trigger pattern definition; the paper fixes these to attacker-controlled values.
  • Backdoor percentage = 0.5% to 10%, with 2% reported in Table I
    Fraction of training data drawn from the poisoned PCAP; central to the low-poisoning claim.
assumptions (5)
  • domain assumption Raw packet modifications propagate to the flow statistics used by the feature extractor.
    Central to the attack; if the feature extractor discards or transforms packet-level changes, the trigger will not affect features. Invoked in Sections II-C and III-A.
  • domain assumption The attacker knows which features are used for training.
    Stated in the threat model in Section II-C; if features are unknown, trigger design may fail.
  • domain assumption The victim trains directly on the attacker-supplied poisoned PCAP without sanitization.
    The threat model assumes the victim uses third-party or public PCAP data and does not filter injected packets; see Sections II-C and IV-C.
  • domain assumption Wireshark-style protocol warnings are an adequate proxy for detection by a real traffic analyzer.
    Used in Section III to justify trigger design; a real defense could use other detection methods.
  • domain assumption Activation clustering is a representative state-of-the-art backdoor defense.
    Section VI uses only this defense; the undetectability conclusion is limited to this method.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PCAP-Backdoor: Backdoor Poisoning Generator for Network Traffic in CPS/IoT Environments." pith.science (2026). https://pith.science/paper/EW6KAWAN

@misc{pith2026250115563,
  author       = {Pith},
  title        = {Pith review of: PCAP-Backdoor: Backdoor Poisoning Generator for Network Traffic in CPS/IoT Environments},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EW6KAWAN}},
  note         = {Machine review of arXiv:2501.15563}
}
read the original abstract

The rapid expansion of connected devices has made them prime targets for cyberattacks. To address these threats, deep learning-based, data-driven intrusion detection systems (IDS) have emerged as powerful tools for detecting and mitigating such attacks. These IDSs analyze network traffic to identify unusual patterns and anomalies that may indicate potential security breaches. However, prior research has shown that deep learning models are vulnerable to backdoor attacks, where attackers inject triggers into the model to manipulate its behavior and cause misclassifications of network traffic. In this paper, we explore the susceptibility of deep learning-based IDS systems to backdoor attacks in the context of network traffic analysis. We introduce \texttt{PCAP-Backdoor}, a novel technique that facilitates backdoor poisoning attacks on PCAP datasets. Our experiments on real-world Cyber-Physical Systems (CPS) and Internet of Things (IoT) network traffic datasets demonstrate that attackers can effectively backdoor a model by poisoning as little as 1\% or less of the entire training dataset. Moreover, we show that an attacker can introduce a trigger into benign traffic during model training yet cause the backdoored model to misclassify malicious traffic when the trigger is present. Finally, we highlight the difficulty of detecting this trigger-based backdoor, even when using existing backdoor defense techniques.

Figures

Figures reproduced from arXiv: 2501.15563 by the authors.

Figure 1
Figure 1. Illustration of clean label backdoor attacks on network [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. TCP ACKed unseen segment, and TCP ports reused [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. An illustration of PCAP-Backdoor injection technique. During the training phase, a small portion of the benign packets are poisoned. During the attack phase, attack packets are poisoned; thus, the model predicts them as benign. Algorithm 2 Bidirectional backdoor trigger generation. Input: (ptx, prx) is the pair of clean bidirectional packets taken from a predefined time window with packet lengths of (ltx, lrx) respe… view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Wireshark view of original bidirectional packets and [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Model performance on various attack types. [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Confusion matrix on the Modbus MITM attack. [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 8
Figure 8. Figure 8: Backdoor performance of different network attack data [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]
Figure 7
Figure 7. Figure 7: Confusion matrix on the Fuzzing attack dataset. [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 10
Figure 10. Figure 10: Performance on various feature sets. 3 5 8 Trigger packet count 0.0 0.2 0.4 0.6 0.8 1.0 ASR CPS-Mitm Fuzzing WireTapping [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]
Figure 11
Figure 11. Figure 11: Performance on varying packet count. Takeaway: Despite variations in backdoor performance across different feature extractors, the attack remains effec￾tive overall. Interestingly, we found that packet-size-related features are more susceptible to backdoor attacks com…
Figure 12
Figure 12. Figure 12: Activations of the last hidden layer of backdoored model on normal data and attack packets with trigger classified [PITH_FULL_IMAGE:figures/full_fig_p011_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 24 canonical work pages

  1. [22]

    Detecting backdoor attacks on deep neural networks by activation clustering,

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728 , 2018

    arXiv 2018

  2. [1]

    Zscaler threatlabz 2023 enterprise iot and ot threat report,

    “Zscaler threatlabz 2023 enterprise iot and ot threat report,” https://info.zscaler.com/ resources-industry-reports-threatlabz-2023-enterprise-ioT-ot-threat-report, 2023, (Accessed Nov 2024)

    work page 2023

  3. [2]

    A deep learning approach for network intrusion detection system,

    A. Javaid, Q. Niyaz, W. Sun, and M. Alam, “A deep learning approach for network intrusion detection system,” in Proceedings of the 9th EAI International Conference on Bio-inspired Information and Communica- tions Technologies (formerly BIONETICS) , 2016, pp. 21–26

    work page 2016

  4. [3]

    N-baiot—network-based detection of iot botnet attacks using deep autoencoders,

    Y . Meidan, M. Bohadana, Y . Mathov, Y . Mirsky, A. Shabtai, D. Breiten- bacher, and Y . Elovici, “N-baiot—network-based detection of iot botnet attacks using deep autoencoders,” IEEE Pervasive Computing , vol. 17, no. 3, pp. 12–22, 2018

    2018

  5. [4]

    Adversarial robustness toolbox v1. 0.0,

    M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V . Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig et al., “Adversarial robustness toolbox v1. 0.0,” arXiv preprint arXiv:1807.01069 , 2018

    arXiv 2018

  6. [5]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access , vol. 7, pp. 47 230–47 244, 2019

    2019

  7. [6]

    Effective backdoor defense by exploit- ing sensitivity of poisoned samples,

    W. Chen, B. Wu, and H. Wang, “Effective backdoor defense by exploit- ing sensitivity of poisoned samples,” Advances in Neural Information Processing Systems, vol. 35, pp. 9727–9737, 2022

    work page 2022

  8. [7]

    Fooling automated surveil- lance cameras: adversarial patches to attack person detection,

    S. Thys, W. Van Ranst, and T. Goedem ´e, “Fooling automated surveil- lance cameras: adversarial patches to attack person detection,” in Pro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, 2019, pp. 0–0

    2019

Show all 35 references
  1. [8]

    Adversarial t-shirt! evading person detectors in a physical world,

    K. Xu, G. Zhang, S. Liu, Q. Fan, M. Sun, H. Chen, P.-Y . Chen, Y . Wang, and X. Lin, “Adversarial t-shirt! evading person detectors in a physical world,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16 . Springer,...

    2020

  2. [9]

    Triggerless backdoor attack for nlp tasks with clean labels,

    L. Gan, J. Li, T. Zhang, X. Li, Y . Meng, F. Wu, Y . Yang, S. Guo, and C. Fan, “Triggerless backdoor attack for nlp tasks with clean labels,” arXiv preprint arXiv:2111.07970 , 2021

    2021 arXiv

  3. [10]

    Hidden trigger backdoor attack on {NLP} models via linguistic style manipulation,

    X. Pan, M. Zhang, B. Sheng, J. Zhu, and M. Yang, “Hidden trigger backdoor attack on {NLP} models via linguistic style manipulation,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 3611–3628

    2022

  4. [11]

    Analysis of various packet sniffing tools for network monitoring and analysis,

    P. Asrodia and H. Patel, “Analysis of various packet sniffing tools for network monitoring and analysis,” International Journal of Electrical, Electronics and Computer Engineering , vol. 1, no. 1, pp. 55–58, 2012

    2012

  5. [12]

    Real-time network intrusion detection system based on deep learning,

    Y . Dong, R. Wang, and J. He, “Real-time network intrusion detection system based on deep learning,” in 2019 IEEE 10th International Conference on Software Engineering and Service Science (ICSESS) , 2019, pp. 1–4

    2019

  6. [13]

    Pcapplusplus,

    “Pcapplusplus,” https://pcapplusplus.github.io/community, 2024, (Ac- cessed Apr 2024)

    2024

  7. [14]

    Wireshark,

    “Wireshark,” https://www.wireshark.org/docs/man-pages/tshark.html, 2024, (Accessed Apr 2024)

    2024

  8. [15]

    Kitsune: an ensemble of autoencoders for online network intrusion detection,

    Y . Mirsky, T. Doitshman, Y . Elovici, and A. Shabtai, “Kitsune: an ensemble of autoencoders for online network intrusion detection,” arXiv preprint arXiv:1802.09089, 2018

    2018 arXiv

  9. [16]

    Federated intrusion detection for iot with heterogeneous cohort privacy,

    A. K. Chathoth, A. Jagannatha, and S. Lee, “Federated intrusion detection for iot with heterogeneous cohort privacy,” arXiv preprint arXiv:2101.09878, 2021

    2021 arXiv

  10. [17]

    Differentially private federated continual learning with heterogeneous cohort privacy,

    A. K. Chathoth, C. P. Necciai, A. Jagannatha, and S. Lee, “Differentially private federated continual learning with heterogeneous cohort privacy,” in 2022 IEEE International Conference on Big Data (Big Data) . IEEE, 2022, pp. 5682–5691

    2022

  11. [18]

    A backdoor attack against lstm-based text classification systems,

    J. Dai, C. Chen, and Y . Li, “A backdoor attack against lstm-based text classification systems,” IEEE Access, vol. 7, pp. 138 872–138 878, 2019

    2019

  12. [19]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in 25th Annual Network and Dis- tributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-221, 2018 . The Internet Society, 2018

    2018

  13. [20]

    Kumar, Y

    N. Kumar, Y . Ramdoss, and Y . Orzach, Network Analysis Using Wire- shark 2 Cookbook: Practical recipes to analyze and secure your network using Wireshark 2. Packt Publishing Ltd, 2018

    2018

  14. [21]

    Denial of service attacks: Detecting the frailties of machine learning algorithms in the classification process,

    I. Fraz ˜ao, P. H. Abreu, T. Cruz, H. Ara ´ujo, and P. Sim ˜oes, “Denial of service attacks: Detecting the frailties of machine learning algorithms in the classification process,” in Critical Information Infrastructures Secu- rity: 13th International Conference, CRITIS 2018, K...

    2018

  15. [23]

    Visualizing data using t-sne

    L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research , vol. 9, no. 11, 2008

    2008

  16. [24]

    Invisible poison: A blackbox clean label backdoor attack to deep neural networks,

    R. Ning, J. Li, C. Xin, and H. Wu, “Invisible poison: A blackbox clean label backdoor attack to deep neural networks,” in IEEE INFOCOM 2021 - IEEE Conference on Computer Communications , 2021, pp. 1– 10

    2021

  17. [25]

    Dynamic black-box backdoor attacks on iot sensory data,

    A. K. Chathoth and S. Lee, “Dynamic black-box backdoor attacks on iot sensory data,” in 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA). IEEE, 2024, pp. 182–191

    2024

  18. [26]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” in Proceedings of the IEEE/CVF international conference on computer vision , 2021, pp. 16 463–16 472

    2021

  19. [27]

    Input-aware dynamic backdoor attack,

    T. A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,” Advances in Neural Information Processing Systems , vol. 33, pp. 3454– 3464, 2020

    2020

  20. [28]

    A novel way to generate adversarial network traffic samples against network traffic classification,

    Y . Hu, J. Tian, and J. Ma, “A novel way to generate adversarial network traffic samples against network traffic classification,” Wirel. Commun. Mob. Comput., vol. 2021, pp. 1–12, Aug. 2021

    2021

  21. [29]

    Backdoor poisoning of encrypted traffic classifiers,

    J. T. Holodnak, O. Brown, J. Matterer, and A. Lemke, “Backdoor poisoning of encrypted traffic classifiers,” in 2022 IEEE International Conference on Data Mining Workshops (ICDMW) . IEEE, 2022, pp. 577–585

    2022

  22. [30]

    Addressing adversarial attacks against security systems based on machine learning,

    G. Apruzzese, M. Colajanni, L. Ferretti, and M. Marchetti, “Addressing adversarial attacks against security systems based on machine learning,” in 2019 11th international conference on cyber conflict (CyCon) , vol

    2019

  23. [31]

    Trojanflow: A neural backdoor attack to deep learning-based network traffic classifiers,

    R. Ning, C. Xin, and H. Wu, “Trojanflow: A neural backdoor attack to deep learning-based network traffic classifiers,” in IEEE INFOCOM 2022-IEEE Conference on Computer Communications . IEEE, 2022, pp. 1429–1438

    2022

  24. [32]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” Advances in neural information processing systems , vol. 31, 2018

    2018

  25. [33]

    Defending neural backdoors via genera- tive distribution modeling,

    X. Qiao, Y . Yang, and H. Li, “Defending neural backdoors via genera- tive distribution modeling,” Advances in neural information processing systems, vol. 32, 2019

    2019

  26. [34]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 707–723

    2019

  27. [900]

    IEEE, 2019, pp. 1–18

    2019

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.