Improving the Reliability of Anomaly Detection for Encrypted OPC UA Traffic over Private 5G
Paper proposes control-plane-aware threshold adaptation that cuts false positives in encrypted OPC UA traffic anomaly detection on industrial private 5G.
The arXiv paper addresses false positives in payload-agnostic anomaly detection for encrypted OPC UA traffic over industrial private 5G networks. The authors build a temporal control-plane context from user-equipment-level indicators and apply a CP-specific threshold for four frozen IDS models, leaving the original threshold active outside that context. Evaluation on a real industrial private 5G testbed showed the adaptation reduces both global FPR and FPR within the CP context, with a configurable trade-off between FPR reduction and retained recall, all without retraining models.
- Benign 5G connectivity variations raise false positives for all four tested IDS models
- False positives concentrate in periods tied to control-plane activity
- CP-aware threshold adaptation requires no retraining or model changes
- Trade-off between false positive reduction and recall is configurable
From the original article
1 min read at arxiv.orgOpen Platform Communications Unified Architecture (OPC UA) is increasingly deployed over private 5G networks in industrial environments, where end-to-end encryption prevents payload inspection by network-based intrusion detection systems (IDSs).
By Song Son Ha · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.