KEYSER: Stateful Adversarial Campaign Evaluation of ML-Based Intrusion Detection in Industrial Automation

Abstract

Industrial automation environments face persistent adversarial threats that signature-based detection cannot address, driving deployment of Machine Learning-based Intrusion Detection Systems (ML-IDS) at the Information Technology / Operational Technology boundary. Adversarial Machine Learning research treats evasion as an isolated, stateless perturbation, whereas operational risk arises from sustained multi-phase campaigns. No current tooling combines adversarial attack algorithms with multi-phase campaign orchestration and benign-traffic feature-envelope constraints. KEYSER closes this gap through two contributions: a 16-phase Finite State Machine aligned with the MITRE ATLAS taxonomy that enforces dependency-ordered execution and propagates a cross-phase artifact chain; and an automatic paradigm-selection rule at the Defense Evasion phase that dispatches by a measured target-hardness ratio $\gamma=\max (S) / \tau$. A large $\gamma$ means the perturbation budget cannot bridge the score-to-threshold gap, so the rule selects distribution-mimicry; a $\gamma$ near unity means the decision boundary is reachable, so it selects Projected Gradient Descent. On KISTE, a production-style multi-stage industrial autoencoder, the mimicry branch reaches an Evasion Success Rate of 0.454 over $N=30$ paired seeds, a gain of 44.1 percentage points over the stateless baseline $(p<0.001)$; on KitNET the gradient branch adds 15.4 points. At matched query budgets, Hop-SkipJump, Zeroth-Order Optimization, and a non-calibrated mimicry generator stay below 0.01 Evasion Success Rate, and HopSkipJump remains below 0.005 at ten times the budget. KEYSER wins every paired seed against all three baselines.