Search papers, labs, and topics across Lattice.
This paper investigates the interplay between residual structural observability and attack detectability in encrypted OPC UA traffic, employing a novel Structural Leakage Score (SLS) to quantify this relationship. By analyzing data from an industrial private 5G testbed across multiple attack families, the authors reveal that while SLS aligns with within-family recall trends, it fails to accurately predict cross-family detectability. The findings highlight the importance of considering temporal and structural factors in enhancing the effectiveness of machine learning-based intrusion detection systems (IDSs) in encrypted environments.
The Structural Leakage Score reveals critical mismatches in attack detectability that challenge conventional wisdom about machine learning IDS performance in encrypted traffic.
OPC Unified Architecture (OPC UA) encryption conceals application-layer semantics and restricts intrusion detection to residual communication structure. Although machine learning-based intrusion detection systems (IDSs) can detect attacks in encrypted OPC UA traffic, the relationship between residual structural observability and attack detectability remains insufficiently understood. This paper presents an explanatory framework combining a structural observability profile, the Structural Leakage Score (SLS), controlled within-family and cross-family comparisons, phase-specific analysis, and dimension-ablation analysis. Jensen--Shannon divergence is used to characterize transport, temporal, and protocol-lifecycle dimensions, while the SLS summarizes the residual structural magnitude. Evaluation on an industrial private 5G testbed covers four attack families with progressively reduced nominal activity. SLS generally tracks within-family recall trends but does not reproduce cross-family detectability ordering. Interpreting these mismatches also requires temporal prevalence, inter-burst persistence, predictive utility, unique contribution, and redundancy. The framework complements conventional IDS metrics by relating detection outcomes to the magnitude, temporal distribution, and predictive role of observable structural evidence.
