PaperlayerView exact revision on arXiv

Source-linked AI summary

Improving the Reliability of Anomaly Detection for Encrypted OPC UA Traffic over Private 5G

Song Son Ha, Florian Foerster, Henry Beuster, Tim Kittel, Dominik Merli, Gerd Scholl

arXiv:2609.29745v1cs.CR

TL;DR

Benign private 5G connectivity variations can raise false positives for encrypted OPC UA traffic, whose payload cannot be inspected by network-based IDSs. The paper adapts decisions of frozen IDS models using UE-level CP context, without changing traffic scores or model parameters. Tests show false positives concentrate around CP activity and that adaptation reduces FPR with a configurable campaign-recall trade-off.

  • Problem

    Benign private 5G connectivity variations can change observable user-plane behavior and increase false positives for traffic-based IDSs.

    Source: §1 · p. 2

  • Method

    The method applies a validation-selected CP-specific threshold within UE-level CP context while retaining the original threshold outside it and leaving the frozen IDS unchanged.

    Source: §1 · p. 2

  • Results

    All four models had higher FPR under connectivity variations, with false positives concentrated in CP-context intervals; adaptation reduced global and CP-context FPR with a configurable campaign-recall trade-off.

    Source: §6 · pp. 10–11

  • Takeaways & Limitations

    CP context can improve encrypted-traffic IDS operational reliability while preserving the underlying traffic-based detector.

    Source: §1 · p. 2, §6 · p. 10

    Evaluation covers four controlled connectivity variations, four OPC UA attack families, and one industrial private 5G testbed.

    Source: §6 · p. 11

Abstract

from arXiv · show

Open Platform Communications Unified Architecture (OPC UA) is increasingly deployed over private 5G networks in industrial environments, where end-to-end encryption prevents payload inspection by network-based intrusion detection systems (IDSs). Although payload-agnostic statistical features extracted from encrypted traffic enable traffic-based anomaly detection, benign connectivity variations may alter observable user-plane (UP) behavior and increase the false-positive rate (FPR). This paper investigates this reliability problem and proposes a control-plane (CP)-aware decision adaptation for four frozen IDS models. CP indicators at the user equipment (UE) level are used to construct a temporal CP context in which a CP-specific threshold selected on adaptation validation data is applied, while the original threshold remains active outside the context. The traffic features, attack scores, preprocessing procedure, and trained model parameters remain unchanged. Evaluation on a real industrial private 5G testbed shows that benign connectivity variations increase the FPR for all four evaluated models and that false positives are concentrated within periods temporally associated with CP activity. The proposed CP-aware decision adaptation reduces both global FPR and FPR within the CP context while introducing a configurable trade-off between FPR reduction and retained recall over the complete attack campaign. These findings demonstrate that CP context can improve the operational reliability of encrypted-traffic intrusion detection without retraining the underlying models.

1 Introduction

Encrypted OPC UA traffic limits network-side monitoring to payload-agnostic characteristics, while benign private 5G connectivity changes can increase IDS false positives. This paper moves from interpreting CP activity to using it to adapt decisions from frozen IDS models.

1 Introduction

  • Benign UE reconnections, PDU session changes, and interruptions can alter user-plane traffic and raise false positives by resembling application anomalies.Observable changes include traffic intensity, timing, and session behavior.Source: §1 · p. 2
  • A preceding study linked elevated attack scores to CP activity but did not adapt IDS decisions or test adaptation with attacks and benign variations in the same capture.Source: §1 · p. 2
  • The work quantifies false-positive concentration inside and outside temporal CP context across four frozen IDS models under controlled benign connectivity variations.Source: §1 · p. 2
  • The CP-aware adaptation applies a CP-specific threshold within temporal CP context while preserving the underlying traffic-based IDS.Source: §1 · p. 2
  • Validation selects operating points under explicit campaign-recall constraints, then evaluates them on separate benign-variation and mixed variation–attack captures.Source: §1 · p. 2

2 Related Work

Prior work establishes that encrypted-traffic monitoring is feasible and that context-dependent thresholds are known, but it does not address benign UE-level 5G CP activity gating decisions of an unchanged encrypted-traffic detector.

2 Related Work

  • Encrypted-traffic classifiers can degrade under deployment drift or dynamic network conditions, motivating attention to changing traffic-derived behavior.Statistical features can include packet sizes, timing, directionality, and flow statistics.Source: §2 · p. 2
  • Prior encrypted OPC UA and industrial studies address encrypted-traffic monitoring and attack detection, but not benign private 5G connectivity effects on a frozen detector’s operating point.Source: §2 · pp. 2–3
  • 5G CP anomaly studies analyze signaling, while this work uses CP indicators only as temporal context rather than IDS inputs or classified signals.Source: §2 · p. 3
  • Context-dependent thresholding is established in anomaly detection, but prior approaches do not use transient UE-level CP activity to gate thresholds for an unchanged encrypted-traffic detector.Source: §2 · p. 3
  • Building on earlier findings that benign connectivity variations raise FPR and elevated scores associate temporally with CP activity, this study evaluates threshold adaptation on mixed variation–attack captures.Source: §2 · p. 3

3 Proposed Methodology

Section 3 presents the proposed CP-aware decision adaptation for encrypted OPC UA traffic over private 5G.

3 Proposed Methodology

  • The section introduces the proposed CP-aware decision adaptation for encrypted OPC UA traffic over private 5G.Source: §3 · p. 3

3.1 Overview of the Proposed CP-Aware Decision Adaptation

The adaptation uses CP context at the decision stage of a frozen traffic-based IDS. It applies a validation-selected CP-specific threshold during connectivity activity and retains the original threshold outside that context.

3.1 Overview of the Proposed CP-Aware Decision Adaptation

  • A frozen IDS scores fixed-window encrypted user-plane traffic, while aligned UE-level CP indicators define temporal context for threshold selection.The CP-specific threshold applies within that context; the original threshold remains active outside it, and CP information does not alter attack scores.Source: §3.1 · p. 3

3.2 Threat Model

The threat model assumes encrypted, authenticated OPC UA traffic over private 5G and considers malicious behavior from a compromised authorized endpoint. Benign connectivity variations are in scope, while manipulation of CP telemetry is not.

3.2 Threat Model

  • The adversary may control or compromise an authorized OPC UA endpoint and generate syntactically valid malicious behavior within encrypted sessions, without breaking cryptography.Attacks are reflected in observable traffic dynamics rather than malformed packets or explicit protocol violations.Source: §3.2 · p. 3
  • Benign connectivity variations are not adversary-initiated, and the adaptation assumes UE-level CP telemetry is trusted and correctly time-aligned with UP observations.Adversarial CP-telemetry manipulation and intentional triggering of CP activity are outside the threat model.Source: §3.2 · p. 3

3.3 Traffic Representation and Frozen IDS Models

The study represents encrypted OPC UA traffic in fixed windows and evaluates four frozen IDS models without changing their traffic pipeline or original thresholds.

3.3 Traffic Representation and Frozen IDS Models

  • Captures are divided into consecutive, non-overlapping 5 s windows, each represented by a feature vector aggregating flow-level measurements.Features summarize traffic volume and direction, temporal and flow dynamics, and observable OPC UA framing and lifecycle activity.Source: §3.3 · p. 3
  • Table 1 summarizes UE-level CP indicators extracted from NAS and NGAP traces.The caption identifies the table's scope but does not specify its individual entries.Source: Table 1 · p. 4
  • The evaluated frozen models are Logistic Regression, Random Forest, radial-basis-function SVM, and XGBoost.Traffic representation, preprocessing, model parameters, score functions, and original thresholds remain fixed; CP indicators affect only decision adaptation.Source: §3.3 · p. 4

3.4 CP Context Indicators

UE-level CP signaling supplies temporal context for connectivity activity, while the encrypted UP traffic remains the input to the traffic-based IDS.

3.4 CP Context Indicators

  • UE-level NAS and NGAP indicators identify connectivity procedures; in mixed captures, indicators come from the UE subjected to variation, not the attacked UE.The indicators are collected from the core-network operations and monitoring framework, and only signaling associated with the UE subjected to variation is processed.Source: §3.4 · p. 4
  • Procedure-specific indicators cover registration, CM state transitions, PDU-session activity, and access-side PDU resource procedures.An aggregate CP signaling count also captures activity outside the selected procedure-specific indicators and provides an extraction consistency check.Source: §3.4 · p. 4
  • A window is CP-active if any context-vector component is nonzero; nearby active windows are clustered, then extended with configurable pre- and post-padding.The maximum internal gap and padding are selected on benign-variation adaptation validation captures and fixed before test evaluation.Source: §3.4 · p. 4

3.5 CP-Aware Decision Adaptation

The adaptation changes only the decision threshold: it applies a CP-specific threshold during a temporal CP context and retains the original threshold outside it. Candidate operating points are selected on validation data under recall constraints and evaluated on separate test captures.

3.5 CP-Aware Decision Adaptation

  • The method preserves each frozen model and its attack score, using CP context only to change the decision threshold.CP indicators are not model inputs and do not affect the attack score.Source: §3.5 · p. 4

3.5.1 Decision Rule with CP Context

  • Within the temporal CP context, a CP-specific threshold is used; outside it, the original threshold remains active, and context does not imply a window is benign.Genuine attacks may also occur during CP activity, so threshold selection is constrained by recall over the complete attack campaign.Source: §3.5.1 · pp. 4–5

3.5.2 Construction of Tested Thresholds

  • Candidate thresholds are derived from scores of original false positives on benign validation data and correct attack predictions on mixed validation data.Raising the CP-specific threshold may suppress the former but also remove the latter; repeated score values are considered once.Source: §3.5.2 · p. 5
  • Every tested threshold is at least the original threshold, which remains an available operating point; therefore, adaptation can suppress but cannot add attack predictions within context.The procedure tests the smallest representable threshold above each selected score so that windows at that score fall below the threshold.Source: §3.5.2 · p. 5

3.5.3 Selection of Operating Points

  • For each tolerance, selection minimizes validation global FPR subject to a campaign-recall reduction limit and an attack-burst recall safeguard.When minimum-FPR thresholds tie, the procedure prefers smaller maximum campaign or attack-burst recall reduction, then smaller inter-burst recall reduction, then a smaller threshold increase.Source: §3.5.3 · pp. 5–6

3.5.4 Test Evaluation

  • Test captures are separate from threshold and operating-point selection; outside-context FPR is unchanged, and test campaign-recall reduction may exceed the validation tolerance.Global and within-context FPR are measured on benign-variation test captures, while campaign recall is measured on mixed variation–attack test captures.Source: §3.5.4 · p. 6

4 Implementation

Implementation combines an encrypted OPC UA industrial testbed with controlled attack and connectivity-variation scenarios, capture-level dataset partitions, and validation-based selection of CP-context parameters.

4.1 Experimental Environment

  • 4.1 Experimental Environment: Encrypted OPC UA traffic is mirrored to an IDS backend for feature extraction, while separately collected UE-level CP traces are aligned with UP observations.The standalone Release 16 testbed uses SignAndEncrypt; extraction preserves observable traffic and OPC UA framing without decrypting service payloads.Source: §4.1 · pp. 6–7

4.2 Attack Scenarios

  • 4.2 Attack Scenarios: Four attack families target address-space traversal, subscription processing, SecureChannel and session resources, and browse-path resolution at four configuration levels.Attacks run as repeated bursts separated by inter-burst intervals.Source: §4.2 · p. 7

4.3 Controlled Connectivity Variation Scenarios

  • 4.3 Controlled Connectivity Variation Scenarios: Four benign procedures are triggered on selected UEs to produce representative CP signaling and UP communication changes without malicious application behavior.Table 2 summarizes the procedures, expected effects, and representative industrial contexts.Source: §4.3 · p. 7, Table 2 · p. 7

4.4 Dataset Construction and Partitioning

  • 4.4 Dataset Construction and Partitioning: The dataset contains 522 nominal 10-minute captures, split by capture before non-overlapping 5-second windows are extracted.Stable benign and malicious-only captures support model development; benign-variation and mixed variation–attack captures are divided into adaptation-validation and test subsets, with the mixed captures placing variation and attack on different UEs.Source: §4.4 · pp. 7–8

4.5 CP Context Parameter Selection

  • 4.5 CP Context Parameter Selection: A five-window internal gap stabilized CP activity cluster counts, and seven-window post-padding was selected for false-positive coverage with limited context expansion.Pre-padding was set to zero because it offered comparatively limited additional coverage while increasing the fraction of windows in context; parameters were then fixed for testing.Source: §4.5 · p. 8

5 Evaluation Results

Benign connectivity variations raised FPR across all four frozen IDSs, with false positives concentrated in CP-context intervals. CP-aware thresholds reduced FPR while trading off retained campaign recall.

5.1.1 FPR under Benign Variations

  • Benign variations raised FPR for all models: LogReg 4.99%→7.27%, RF 4.60%→5.14%, SVM 4.86%→7.59%, and XGBoost 4.95%→6.73%.The comparison is between stable-benign and benign-variation test sets.Source: §5.1.1 · p. 8, Figure 2 · p. 9

5.1.2 FPR within and outside the CP Context

  • Within the CP context, covering 27.1% of the timeline, FPR was 6.94–13.42%, versus 4.47–5.96% outside it.Table 4 compares FPR within and outside the context on the benign variation test set.Source: Table 4 · p. 9, §5.1.2 · p. 9
  • Within-context FPR increases ranged from 55.0% for RF to 147.5% for SVM, indicating false positives concentrated in CP-associated intervals.The increase direction was consistent across all four models.Source: §5.1.2 · p. 9

5.2 CP-Aware Adaptation

  • Higher δval reduces global and CP-context FPR while increasing campaign recall reduction; unchanged thresholds across the other 72.9% of TWs limit global gains.The adapted threshold is applied only within the CP context.Source: §5.2 · pp. 9–10
  • At δval = 5 pp, global FPR fell 26.6–37.8% and CP-context FPR 72.5–81.1%, with campaign recall reductions of 5.36–6.27 pp.Table 5 reports test-set outcomes for operating points selected on adaptation validation data.Source: Table 5 · p. 10, §5.2 · p. 10
  • At δval = 0 pp, global FPR fell 0.5% and CP-context FPR 1.3%, while campaign recall decreased 0.01 pp.RF, SVM, and XGBoost retained their original thresholds; LogReg used 0.4527 instead of 0.4510.Source: §5.2 · p. 10
  • At δval = 0.5 pp, global FPR fell 3.1–11.0% and CP-context FPR fell 8.5–23.0%, while campaign recall decreased 0.41–0.85 pp.Source: §5.2 · p. 10
  • Validation recall constraints did not guarantee test-set bounds: SVM exceeded them at 0.5 pp, and SVM and XGBoost at 1 pp.Test results were not used to reselect thresholds.Source: §5.2 · pp. 9–10

6 Conclusion and Future Work

Benign connectivity variations raised FPR across all four evaluated models, and false positives were more frequent within the temporal CP context. CP-aware adaptation reduced FPR with a configurable trade-off against campaign recall, within an evaluation limited to one industrial private 5G testbed.

6 Conclusion and Future Work

  • All four models had higher FPR under benign connectivity variations, with false positives more frequent in intervals associated with UE connectivity activity.The evaluation used frozen IDS models for encrypted OPC UA traffic.Source: §6 · p. 10
  • CP-aware decision adaptation reduced global and CP-context FPR while offering a trade-off between FPR reduction and retained campaign recall.Conservative tolerances preserve most campaign recall with moderate FPR reduction; more permissive tolerances yield larger reductions at larger recall cost.Source: §6 · pp. 10–11
  • Evaluation covered four controlled connectivity variations, four OPC UA attack families, and one industrial private 5G testbed; transferability remains to be assessed.Future work will consider additional procedures, network configurations, and industrial applications.Source: §6 · p. 11
Loading 2609.29745v1…