mireabulletinRussian Technological JournalRussian Technological Journal2782-32102500-316XRTU MIREA10.32362/2500-316X-2026-14-5-26-40WXRQJGmireabulletin-1657Research ArticleИНФОРМАЦИОННЫЕ СИСТЕМЫ. ИНФОРМАТИКА. ПРОБЛЕМЫ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИINFORMATION SYSTEMS. COMPUTER SCIENCES. ISSUES OF INFORMATION SECURITYКлассификация угроз безопасности моделей машинного обучения в системах экологического мониторинга и количественная оценка сценариев атакTaxonomy of security threats to machine learning models in environmental monitoring systems with quantitative assessment of attack scenarioshttps://orcid.org/0000-0001-6191-8614КозачокА. В.KozachokA. V.

Андрей Васильевич Козачок, к. т. н., доцент

Институт кибербезопасности и цифровых технологий; кафедра КБ-4 «Интеллектуальные системы информационной безопасности», 

119454;  пр-т Вернадского, д. 78; Москва

Andrey V. Kozachok, Cand. Sci. (Eng.), Associate Professor

Institute of Cybersecurity and Digital Technologies; Department of Intelligent Information Security Systems

119454; 78, Vernadskogo pr.; Moscow

kozachok@mirea.ruhttps://orcid.org/0009-0003-2019-8536НоевА. Н.NoevA. N.

Артем Николаевич Ноев, к. т. н., исполняющий обязанности заведующего кафедрой

Институт кибербезопасности и цифровых технологий; кафедра КБ-4 «Интеллектуальные системы информационной безопасности»

119454; пр-т Вернадского, д. 78; Москва

Artem N. Noev, Cand. Sci. (Eng.), Acting Head of the Department

Institute of Cybersecurity and Digital Technologies; Department of Intelligent Information Security Systems

119454; 78, Vernadskogo pr.; Moscow

noev_a@mirea.ruМатюхинаЕ. Н.MatyukhinaE. N.

Екатерина Николаевна Матюхина, к. т. н., доцент

Институт кибербезопасности и цифровых технологий; кафедра КБ-4 «Интеллектуальные системы информационной безопасности»

119454; пр-т Вернадского, д. 78; Москва

Ekaterina N. Matyukhina, Cand. Sci. (Eng.), Associate Professor

Institute of Cybersecurity and Digital Technologies; Department of Intelligent Information Security Systems 

119454; 78, Vernadskogo pr.; Moscow

makaterina_ski@mail.ruМИРЭА – Российский технологический университетРоссияMIREA – Russian Technological UniversityRussian Federation2026081020261452640Copyright © Козачок А.В., Ноев А.Н., Матюхина Е.Н., 20262026Козачок А.В., Ноев А.Н., Матюхина Е.Н.Kozachok A.V., Noev A.N., Matyukhina E.N.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://www.rtj-mirea.ru/jour/article/view/1657   Цели

   Цели. Интеграция машинного обучения (machine learning, ML) в экологический мониторинг создает новый спектр киберугроз. Стандарты безопасности искусственного интеллекта (NIST1, OWASP2) носят общий характер и слабо учитывают специфику природоохранного контроля, в частности зависимость систем экологического мониторинга от данных временных рядов и высокий естественный сенсорный шум.

   Цель работы – разработка специализированной классификации атак на ML-модели и профилирование количественных рисков для автоматизированных систем контроля промышленных выбросов.

   Методы

   Методы. Выполнен аналитический обзор более 25 научных публикаций по проблемам состязательного машинного обучения и защиты промышленного интернета вещей (Internet of Things, IoT). Отбор источников проводился в базах IEEE Xplore3, ACM Digital Library4, Scopus5 и arXiv6 по ключевым словам «adversarial ML»7, «data poisoning»8, «evasion attacks»9, «IoT security»10, «environmental monitoring»11 с приоритетом публикаций 2019–2025 гг. Применены методы структурно-функционального анализа жизненного цикла ML-систем. Проведен синтез доступных экспериментальных данных об уязвимостях нейронных сетей и ансамблевых алгоритмов для формирования количественных оценок успешности воздействия и уровня деградации моделей.

   Результаты

   Результаты. Предложена трехуровневая классификация угроз (отравление данных, атаки уклонения, инверсия моделей), дополненная матрицей уязвимостей по осям «данные – модель – платформа». Показано, что подмена менее 5 % данных в обучающей выборке приводит к скрытому падению точности глубоких нейронных сетей (deep neural network, DNN) на 85 процентных пунктов, а наиболее мощные атаки уклонения достигают успешности 97–99 % против одиночных DNN. Идентифицирована критическая угроза составных атак, комбинирующих дрейф данных IoT с архитектурными слабостями алгоритмов для манипуляции результатами прогнозирования.

   Выводы

   Выводы. Безопасное применение предиктивной аналитики требует обязательного перехода к проактивной архитектуре защиты. Для нейтрализации угроз необходимо использование робастных ансамблевых моделей, регулярного состязательного обучения (adversarial training) и жесткой валидации входящих потоков данных. Определены приоритетные направления дальнейших исследований, центральным элементом которых является разработка эталонных экологических датасетов и метрик киберустойчивости искусственного интеллекта.

   Objectives

   Objectives. The integration of machine learning (ML) into environmental monitoring contexts introduces a new spectrum of cyber threats. The general-purpose nature of current AI security frameworks and guidance (NIST, OWASP) makes them insufficiently tailored to the specific characteristics of environmental monitoring, including time-series data and high inherent sensor noise.

   The present work therefore set out to develop a specialized classification of attacks on ML models used for automated industrial emissions monitoring systems and provide quantitative risk estimates.

   Methods

   Methods. An analytical review of over 25 scientific publications on adversarial machine learning and industrial Internet of Things (IoT) security was carried out. Sources were selected from IEEE Xplore, ACM Digital Library, Scopus, and arXiv prioritizing publications from 2019–2025 using the keywords “adversarial ML”, “data poisoning”, “evasion attacks”, “IoT security”, and “environmental monitoring”. Structural-functional analysis methods were applied to the ML system lifecycle. Available experimental data on neural network and ensemble algorithm vulnerabilities were synthesized to produce quantitative estimates of attack success rates and model degradation levels.

   Results

   Results. A three-tier threat classification is proposed (data poisoning, evasion attacks, and model inversion), supplemented by a vulnerability matrix along the axes of data–model–platform. It is shown that the substitution of less than 5 % of training data results in a covert accuracy drop of 85 percentage points in deep neural networks (DNNs), while the most powerful evasion attacks achieve a success rate of 97–99% against single DNNs. A critical threat posed by composite attacks that combine IoT data drift with architectural weaknesses of algorithms to manipulate forecasting outputs is identified.

   Conclusions

   Conclusions. The secure deployment of predictive analytics requires a mandatory transition to proactive security architecture. To neutralize threats, the use of robust ensemble models, regular adversarial training, and strict validation of incoming data streams becomes necessary. Priority directions for future research involve the development of benchmark environmental datasets and AI cyber-resilience metrics as the central elements.

машинное обучениеэкологический мониторингбезопасность искусственного интеллектаклассификация угрозотравление данныхатаки уклоненияинверсия моделисостязательное машинное обучениеколичественная оценка рисковробастность ML-системmachine learningenvironmental monitoringAI securitythreat classificationdata poisoningevasion attacksmodel inversionadversarial machine learningquantitative risk assessmentML robustnessАвторы не имеют финансовой заинтересованности в представленных материалах или методахThe authors have no financial or proprietary interest in any material or method mentionedReferencesDalvi N., Domingos P., Sanghai S., Verma D. Adversarial classification. In: Proceedings of the 10<sup>th</sup> ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2004. Р. 99–108. doi: 10.1145/1014052.1014066Dalvi N., Domingos P., Sanghai S., Verma D. Adversarial classification. In: Proceedings of the 10<sup>th</sup> ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2004. Р. 99–108. doi: 10.1145/1014052.1014066Barreno M., Nelson B., Sears R., Joseph A.D., Tygar J.D. Can machine learning be secure? In: Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security. 2006. Р. 16–25. doi: 10.1145/1128817.1128824Barreno M., Nelson B., Sears R., Joseph A.D., Tygar J.D. Can machine learning be secure? In: Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security. 2006. Р. 16–25. doi: 10.1145/1128817.1128824Langner R. Stuxnet: Dissecting a cyberweapon. IEEE Secur Priv. 2011;9(3):49–51. doi: 10.1109/MSP.2011.67Langner R. Stuxnet: Dissecting a cyberweapon. IEEE Secur Priv. 2011;9(3):49–51. doi: 10.1109/MSP.2011.67Кочергин С.В., Артемова С.В., Бакаев А.А., Митяков Е.С., Вегера Ж.Г., Максимова Е.А. Кибербезопасность смарт-сетей: сравнение подходов машинного обучения для обнаружения аномалий. Russian Technological Journal. 2024;12(6):7–19. doi: 10.32362/2500-316X-2024-12-6-7-19Kochergin S.V., Artemova S.V., Bakaev A.A., Mityakov E.S., Vegera Zh.G., Maksimova E.A. Cybersecurity of smart grids: comparison of machine learning approaches for anomaly detection. Russian Technological Journal. 2024;12(6):7–19. doi: 10.32362/2500-316X-2024-12-6-7-19Fawaz H.I., Forestier G., Weber J., Idoumghar L., Muller P.A. Adversarial attacks on deep neural networks for time series classification. In: Proceedings of the International Joint Conference on Neural Networks (IJCNN). 2019. doi: 10.1109/IJCNN.2019.8851936Fawaz H.I., Forestier G., Weber J., Idoumghar L., Muller P.A. Adversarial attacks on deep neural networks for time series classification. In: Proceedings of the International Joint Conference on Neural Networks (IJCNN). 2019. doi: 10.1109/IJCNN.2019.8851936Karim F., Majumdar S., Darabi H. Adversarial attacks on time series. IEEE Trans. Pattern Anal. Mach. Intell. 2021;43(10): 3309–3320. doi: 10.1109/TPAMI.2020.2986319Karim F., Majumdar S., Darabi H. Adversarial attacks on time series. IEEE Trans. Pattern Anal. Mach. Intell. 2021;43(10): 3309–3320. doi: 10.1109/TPAMI.2020.2986319Wang J., Yang Y., Jiang Y., et al. Cross-modal incongruity aligning and collaborating for multi-modal sarcasm detection. Inf. Fusion. 2024;103:102132. doi: 10.1016/j.inffus.2023.102132Wang J., Yang Y., Jiang Y., et al. Cross-modal incongruity aligning and collaborating for multi-modal sarcasm detection. Inf. Fusion. 2024;103:102132. doi: 10.1016/j.inffus.2023.102132Mothukuri V., Parizi R.M., Pouriyeh S., Huang Y., Dehghantanha A., Srivastava G. A survey on security and privacy of federated learning. Future Gener. Comput. Syst. 2021;115:619–640. doi: 10.1016/j.future.2020.10.007Mothukuri V., Parizi R.M., Pouriyeh S., Huang Y., Dehghantanha A., Srivastava G. A survey on security and privacy of federated learning. Future Gener. Comput. Syst. 2021;115:619–640. doi: 10.1016/j.future.2020.10.007Cinà A.E., Grosse K., Demontis A., Vascon S., Biggio B., Roli F. Wild patterns reloaded: a survey of machine learning security against training-data poisoning. ACM Comput. Surv. 2023;55(13s):294. doi: 10.1145/3585385Cinà A.E., Grosse K., Demontis A., Vascon S., Biggio B., Roli F. Wild patterns reloaded: a survey of machine learning security against training-data poisoning. ACM Comput. Surv. 2023;55(13s):294. doi: 10.1145/3585385Machado G.R., Silva E., Goldschmidt R.R. Adversarial machine learning in image classification: a survey toward the defender’s perspective. ACM Comput. Surv. 2023;55(1):8. doi: 10.1145/3485133Machado G.R., Silva E., Goldschmidt R.R. Adversarial machine learning in image classification: a survey toward the defender’s perspective. ACM Comput. Surv. 2023;55(1):8. doi: 10.1145/3485133Arafat Z., Yudina O.V., Abdulaziz Z.A. Generative adversarial networks in cybersecurity : a literature review. Russian Technological Journal. 2025;13(5):7–24. doi: 10.32362/2500-316X-2025-13-5-7-24Arafat Z., Yudina O.V., Abdulaziz Z.A. Generative adversarial networks in cybersecurity : a literature review. Russian Technological Journal. 2025;13(5):7–24. doi: 10.32362/2500-316X-2025-13-5-7-24Askhatuly A., Berdysheva D., Berdishev A., et al. Adversarial Attacks and Defense Mechanisms in Machine Learning : A Structured Review of Methods, Domains, and Open Challenges. IEEE Access. 2025;13:185145–185168. doi: 10.1109/ACCESS.2025.3624409Askhatuly A., Berdysheva D., Berdishev A., et al. Adversarial Attacks and Defense Mechanisms in Machine Learning : A Structured Review of Methods, Domains, and Open Challenges. IEEE Access. 2025;13:185145–185168. doi: 10.1109/ACCESS.2025.3624409Mansouri T., Sadeghi Moghadam M.R., Monshizadeh F., Zareravasan A. IoT data quality issues and potential solutions : A literature review. Comput. J. 2023;66(3):615–625. doi: 10.1093/comjnl/bxab183Mansouri T., Sadeghi Moghadam M.R., Monshizadeh F., Zareravasan A. IoT data quality issues and potential solutions : A literature review. Comput. J. 2023;66(3):615–625. doi: 10.1093/comjnl/bxab183Biggio B., Nelson B., Laskov P. Poisoning attacks against support vector machines. In: Proceedings of the 29<sup>th</sup> International Conference on Machine Learning (ICML’12). 2012. Р. 1467–1474. doi: 10.48550/arXiv.1206.6389Biggio B., Nelson B., Laskov P. Poisoning attacks against support vector machines. In: Proceedings of the 29<sup>th</sup> International Conference on Machine Learning (ICML’12). 2012. Р. 1467–1474. doi: 10.48550/arXiv.1206.6389Chen X., Liu C., Li B., Lu K., Song D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint. arXiv:1712.05526; 2017. https://arxiv.org/abs/1712.05526Chen X., Liu C., Li B., Lu K., Song D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint. arXiv:1712.05526; 2017. https://arxiv.org/abs/1712.05526Goodfellow I., Shlens J., Szegedy C. Explaining and harnessing adversarial examples. arXiv preprint. arXiv:1412.6572; 2015. https://arxiv.org/abs/1412.6572Goodfellow I., Shlens J., Szegedy C. Explaining and harnessing adversarial examples. arXiv preprint. arXiv:1412.6572; 2015. https://arxiv.org/abs/1412.6572Madry A., Makelov A., Schmidt L., Tsipras D., Vladu A. Towards deep learning models resistant to adversarial attacks. arXiv preprint. arXiv:1706.06083; 2018. https://arxiv.org/abs/1706.06083Madry A., Makelov A., Schmidt L., Tsipras D., Vladu A. Towards deep learning models resistant to adversarial attacks. arXiv preprint. arXiv:1706.06083; 2018. https://arxiv.org/abs/1706.06083Carlini N., Wagner D. Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (S&P). 2017. https://arxiv.org/abs/1608.04644Carlini N., Wagner D. Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (S&P). 2017. https://arxiv.org/abs/1608.04644Harford S., Karim F., Darabi H. Adversarial attacks on multivariate time series. arXiv preprint. arXiv:2004.00410; 2020. https://arxiv.org/abs/2004.00410Harford S., Karim F., Darabi H. Adversarial attacks on multivariate time series. arXiv preprint. arXiv:2004.00410; 2020. https://arxiv.org/abs/2004.00410Ren K., Zheng T., Qin Z., Liu X. Adversarial attacks and defenses in deep learning. Engineering. 2020;6(3):346–360. doi: 10.1016/j.eng.2019.12.012Ren K., Zheng T., Qin Z., Liu X. Adversarial attacks and defenses in deep learning. Engineering. 2020;6(3):346–360. doi: 10.1016/j.eng.2019.12.012Fredrikson M., Jha S., Ristenpart T. Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22<sup>nd</sup> ACM SIGSAC Conference on Computer and Communications Security (CCS). 2015. Р. 1322–1333. doi: 10.1145/2810103.2813677Fredrikson M., Jha S., Ristenpart T. Model inversion attacks that exploit confidence information and basic countermeasures. In: Proceedings of the 22<sup>nd</sup> ACM SIGSAC Conference on Computer and Communications Security (CCS). 2015. Р. 1322–1333. doi: 10.1145/2810103.2813677Shokri R., Stronati M., Song C., Shmatikov V. Membership inference attacks against machine learning models. In: IEEE Symposium on Security and Privacy (S&P). 2017. Р. 3–18.Shokri R., Stronati M., Song C., Shmatikov V. Membership inference attacks against machine learning models. In: IEEE Symposium on Security and Privacy (S&P). 2017. Р. 3–18.Papernot N., McDaniel P., Goodfellow I., Kolter Z., Mądry A., Song D. Practical black-box attacks against machine learning. In: Proceedings of the ACM Asia Conference on Computer and Communications Security. 2017. Р. 506–519. doi: 10.1145/3052973.3053009Papernot N., McDaniel P., Goodfellow I., Kolter Z., Mądry A., Song D. Practical black-box attacks against machine learning. In: Proceedings of the ACM Asia Conference on Computer and Communications Security. 2017. Р. 506–519. doi: 10.1145/3052973.3053009Feurer M., Hutter F. Hyperparameter optimization. In: Hutter F., Kotthoff L., Vanschoren J. (Eds.). Automated Machine Leaning: Methods, Systems, Challenges. Springer; 2019. Р. 3–33. doi: 10.1007/978-3-030-05318-5_1Feurer M., Hutter F. Hyperparameter optimization. In: Hutter F., Kotthoff L., Vanschoren J. (Eds.). Automated Machine Leaning: Methods, Systems, Challenges. Springer; 2019. Р. 3–33. doi: 10.1007/978-3-030-05318-5_1Wang P., Xiao S., Liu X., et al. Research on missing value imputation to improve the validity of air quality data evaluation on the Qinghai-Tibetan Plateau. Atmosphere. 2023;14(12):1821. doi: 10.3390/atmos14121821Wang P., Xiao S., Liu X., et al. Research on missing value imputation to improve the validity of air quality data evaluation on the Qinghai-Tibetan Plateau. Atmosphere. 2023;14(12):1821. doi: 10.3390/atmos14121821Nicolae M.I., Sinn M., Tran M.N., Buesser B., Rawat A., et al. Adversarial Robustness Toolbox v1.0.0. arXiv preprint. arXiv:1807.01069; 2018. https://arxiv.org/abs/1807.01069Nicolae M.I., Sinn M., Tran M.N., Buesser B., Rawat A., et al. Adversarial Robustness Toolbox v1.0.0. arXiv preprint. arXiv:1807.01069; 2018. https://arxiv.org/abs/1807.01069Abadi M., Chu A., Goodfellow I., McMahan H.B., Mironov I., Talwar K., et al. Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS). 2016. Р. 308–318. doi: 10.1145/2976749.2978318Abadi M., Chu A., Goodfellow I., McMahan H.B., Mironov I., Talwar K., et al. Deep learning with differential privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS). 2016. Р. 308–318. doi: 10.1145/2976749.2978318McMahan B., Moore E., Ramage D., Hampson S., Arcas B.A. Communication-efficient learning of deep networks from decentralized data. In: Proceedings of the 20<sup>th</sup> International Conference on Artificial Intelligence and Statistics (AISTATS). 2017. Р. 1273–1282. http://proceedings.mlr.press/v54/mcmahan17a/mcmahan17a.pdfMcMahan B., Moore E., Ramage D., Hampson S., Arcas B.A. Communication-efficient learning of deep networks from decentralized data. In: Proceedings of the 20<sup>th</sup> International Conference on Artificial Intelligence and Statistics (AISTATS). 2017. Р. 1273–1282. http://proceedings.mlr.press/v54/mcmahan17a/mcmahan17a.pdf

The authors declare that there are no conflicts of interest present.