Impact of Benign Connectivity Variations on Intrusion Detection for Encrypted OPC UA Traffic in Industrial Private 5G Networks

Jul 16, 2026

Upload by Ophelia

Machine learning–based intrusion detection systems for encrypted industrial communication are increasingly deployed, yet their behavior in realistic private 5G operating conditions is not well understood. This paper studies how benign connectivity variations affect ML-based IDS performance for encrypted OPC UA traffic in industrial private 5G networks. Experimental results show legitimate connectivity events can substantially increase false positives even without attacks, and elevated anomaly scores often align with control-plane activity.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

Abstract

Introduction

Related Work

Proposed Methodology

Experimental Workflow

IMPACT OF BENIGN CONNECTIVITY VARIATIONS ON INTRUSION DETECTION FOR ENCRYPTED OPC UA TRAFFIC IN INDUSTRIAL PRIVATE 5G NETWORKS A PREPRINT arXiv :2607 .09659v 1 [ cs .CR] 10 Jul 2026 Song Son Ha Electrical Measurement Engineering Helmut-Schmidt-University Hamburg, Germany [song.ha@hsu-hh.de](song.ha@hsu-hh.de) Henry Beuster Electrical Measurement Engineering Helmut-Schmidt-University Hamburg, Germany [henry.beuster@hsu-hh.de](henry.beuster@hsu-hh.de) Florian Foerster Institute for Innovative Safety and Security Technical University of Applied Sciences Augsburg Augsburg, Germany [florian.foerster@tha.de](florian.foerster@tha.de) Tim Kittel ipoque GmbH A Rohde & Schwarz company Leipzig, Germany [tim.kittel@rohde-schwarz.com](tim.kittel@rohde-schwarz.com) Dominik Merli Institute for Innovative Safety and Security Technical University of Applied Sciences Augsburg Augsburg, Germany [dominik.merli@tha.de](dominik.merli@tha.de) Gerd Scholl Electrical Measurement Engineering Helmut-Schmidt-University Hamburg, Germany [gerd.scholl@hsu-hh.de](gerd.scholl@hsu-hh.de) July 10, 2026 ABSTRACT 1 Machine learning (ML)-based intrusion detection systems (IDSs) are increasingly used to monitor encrypted industrial communication. However, their behavior under realistic private 5G operating conditions remains insufficiently understood. This paper investigates the impact of benign connectivity variations on ML-based IDSs for encrypted Open Platform Communications Unified Architecture (OPC UA) traffic in industrial private 5G networks. Experimental results show that legitimate connectivity events can noticeably increase false positive activity despite the absence of attacks. Furthermore, elevated IDS anomaly scores frequently coincide with periods of control-plane (CP) activity associated with these events. The findings highlight the importance of considering CP context when interpreting IDS outputs in industrial private 5G environments. 1 Introduction The increasing adoption of private 5G networks in industrial environments enables flexible and reliable connectivity for a wide range of industrial applications. In these environments, OPC UA is widely used to support industrial communication and commonly employs message-level security mechanisms to protect sensitive industrial data flows [1] . While such protection enhances confidentiality, it also limits the effectiveness of traditional IDSs that rely on payload inspection. ML-based IDSs have therefore emerged as promising solutions for OPC UA intrusion detection. However, these systems are typically trained under baseline conditions, an assumption that rarely holds in private 5G 1This is the author’s version of a paper that has been accepted for presentation at the 31st IEEE International Conference on Emerging Technologies and Factory Automation (ETFA 2026), to be held in Västerås, Sweden, on September 08–11, 2026 . deployments where benign connectivity variations, such as UE reconnection procedures, PDU session resets, and temporary connectivity interruptions, may occur during normal operation. Although these events are not malicious, they can alter traffic patterns and potentially increase false positive rates (FPR) . This work investigates the impact of benign connectivity variations on ML-based IDS outputs for encrypted OPC UA traffic in the absence of attacks. The results show that benign connectivity variations increase false positive activity and that elevated IDS anomaly scores frequently coincide with periods of CP activity. These findings highlight the importance of considering CP context when interpreting IDS outputs in industrial private 5G environments. The remainder of this paper is organized as follows. Section 2 reviews related work, Sections 3 and 4 describe the methodology and experimental setup, Section 5 presents the evaluation results, and Section 6 concludes the paper and outlines future work. 2 Related Work Monitoring app

FAQs

Why can benign connectivity events increase IDS false positives for encrypted OPC UA traffic?

Benign connectivity variations change observable traffic patterns even without attacks, causing the ML-based IDS—trained on baseline conditions—to flag normal behavior as anomalous, which raises the false positive activity.

What role does control-plane (CP) activity play in IDS outputs?

Elevated IDS anomaly scores frequently coincide with control-plane activity periods associated with connectivity events. This indicates CP context is important when interpreting IDS results in private 5G environments.

How is encrypted OPC UA traffic used for the machine learning IDS evaluation?

Encrypted OPC UA traffic is segmented into consecutive 5-second time windows, converted into statistical feature vectors for the IDS, and assessed under controlled benign connectivity variation scenarios to measure the impact on false positive rate.

Jul 16, 2026

Upload by Ophelia