Attack Detection using Time Series Foundation Models

• URL: http://arxiv.org/abs/2606.06347v1
• Date: Thu, 04 Jun 2026 16:19:24 GMT
• Title: Attack Detection using Time Series Foundation Models
• Abstract summary: This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure.<n>We propose a model-structure-free detector based on TimesFM, a time-series foundation model developed by Google Research.<n>We show empirically that the TimesFM-based detector achieves a comparable or superior attack detection performance.
• Score: 20.398472851483188
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure. A remotely located plant transmits sensor measurements to an operator over a network that is assumed to be under attack. We consider two classes of attacks: model-free replay attacks and model-based stealthy attacks. For the latter, we derive closed-form expressions for the optimal stealthy attack policy against a $χ^2$ detector, for both linear and nonlinear systems. We then propose a model-structure-free detector based on TimesFM, a time-series foundation model developed by Google Research, which serves as a surrogate residual generator operating in a zero-shot fashion. We show empirically that the TimesFM-based detector achieves a comparable or superior attack detection performance. The efficacy of the proposed approach is demonstrated numerically on the IEEE 14-bus power system. We also demonstrate that TimesFM predictions can serve as a substitute for corrupted measurements, a practical mitigation technique when classical redundancy assumptions fail.

Related papers

• Adversarial Training of Linear Models under Stealthy Attacks [5.3909333359654275]
  We propose a detector-based switched model, in which optimal attack strategies are stealthy.<n>For linear prediction models, we derive a convex formulation of the resulting adversarial risk.<n> Numerical simulations on real and synthetic data show improved performance on partially attacked data, even for misspecified attack probabilities.
  arXiv  Detail & Related papers  (2026-08-26T11:57:25Z)
• Defending against Model Extraction for GNNs with Model Reprogramming [57.82196268649236]
  Graph Neural Networks (GNNs) serve as the backbone for high-stakes applications in Machine-Learning-as-a-Service (ML)<n>Still, their black-box deployment exposes them to Model Extraction (ME) attacks.<n>Existing defenses suffer from a critical ''Euclidean bias''<n>We propose GraphRP, a proactive defense framework that repurposes Model Reprogramming for security.
  arXiv  Detail & Related papers  (2026-08-11T23:20:15Z)
• FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems [0.0]
  FlowGuard is an identity-independent defence based on flow matching that classifies incoming queries as out-of-distribution (OOD)<n>This approach exploits the fact that queries generated synthetically for data-free model stealing attacks occupy a lower-dimensional manifold than real network traffic.<n>We evaluate our method against PRADA and FDINet using MAZE and DisGUIDE attacks in single-client and distributed (100-client Sybil) settings.
  arXiv  Detail & Related papers  (2026-06-02T10:18:45Z)
• From Passive Monitoring to Active Defence: Resilient Control of Manipulators Under Cyberattacks [42.72791770760975]
  False data injection attacks (FDIAs) can induce substantial end-effector deviations without triggering alarms.<n>This paper studies the resilience of redundant manipulators to stealthy FDIAs and advances the architecture from passive monitoring to active defence.
  arXiv  Detail & Related papers  (2026-03-13T14:08:41Z)
• MISLEADER: Defending against Model Extraction with Ensembles of Distilled Models [56.09354775405601]
  Model extraction attacks aim to replicate the functionality of a black-box model through query access.<n>Most existing defenses presume that attacker queries have out-of-distribution (OOD) samples, enabling them to detect and disrupt suspicious inputs.<n>We propose MISLEADER, a novel defense strategy that does not rely on OOD assumptions.
  arXiv  Detail & Related papers  (2025-06-03T01:37:09Z)
• FaultGuard: A Generative Approach to Resilient Fault Prediction in Smart Electrical Grids [53.2306792009435]
  FaultGuard is the first framework for fault type and zone classification resilient to adversarial attacks. We propose a low-complexity fault prediction model and an online adversarial training technique to enhance robustness. Our model outclasses the state-of-the-art for resilient fault prediction benchmarking, with an accuracy of up to 0.958.
  arXiv  Detail & Related papers  (2024-03-26T08:51:23Z)
• FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning [98.43475653490219]
  Federated learning (FL) is susceptible to poisoning attacks. FreqFed is a novel aggregation mechanism that transforms the model updates into the frequency domain. We demonstrate that FreqFed can mitigate poisoning attacks effectively with a negligible impact on the utility of the aggregated model.
  arXiv  Detail & Related papers  (2023-12-07T16:56:24Z)
• Pareto-Secure Machine Learning (PSML): Fingerprinting and Securing Inference Serving Systems [0.0]
  Existing black-box attacks assume a single model can be repeatedly selected for serving inference requests. We propose a query-efficient fingerprinting algorithm to enable the attacker to trigger any desired model consistently. We counter the proposed attack with a noise-based defense mechanism that thwarts fingerprinting by adding noise to the specified performance metrics.
  arXiv  Detail & Related papers  (2023-07-03T18:53:47Z)
• Adversarial Poisoning Attacks and Defense for General Multi-Class Models Based On Synthetic Reduced Nearest Neighbors [14.968442560499753]
  State-of-the-art machine learning models are vulnerable to data poisoning attacks. This paper proposes a novel model-free label-flipping attack based on the multi-modality of the data. Second, a novel defense technique based on the Synthetic Reduced Nearest Neighbor (SRNN) model is proposed.
  arXiv  Detail & Related papers  (2021-02-11T06:55:40Z)
• No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems [95.54151664013011]
  We present a novel framework to generate adversarial spoofing signals that violate physical properties of the system. We analyze four anomaly detectors published at top security conferences.
  arXiv  Detail & Related papers  (2020-12-07T11:02:44Z)
• Defense for Black-box Attacks on Anti-spoofing Models by Self-Supervised Learning [71.17774313301753]
  We explore the robustness of self-supervised learned high-level representations by using them in the defense against adversarial attacks. Experimental results on the ASVspoof 2019 dataset demonstrate that high-level representations extracted by Mockingjay can prevent the transferability of adversarial examples.
  arXiv  Detail & Related papers  (2020-06-05T03:03:06Z)
• Active Fuzzing for Testing and Securing Cyber-Physical Systems [8.228859318969082]
  We propose active fuzzing, an automatic approach for finding test suites of packet-level CPS network attacks. Key to our solution is the use of online active learning, which iteratively updates the models by sampling payloads. We evaluate the efficacy of active fuzzing by implementing it for a water purification plant testbed, finding it can automatically discover a test suite of flow, pressure, and over/underflow attacks.
  arXiv  Detail & Related papers  (2020-05-28T16:19:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.