1 Introduction↩︎

The increasing adoption of private 5G networks in industrial environments enables flexible and reliable connectivity for a wide range of industrial applications. In these environments, OPC UA is widely used to support industrial communication and commonly employs message-level security mechanisms to protect sensitive industrial data flows [1]. While such protection enhances confidentiality, it also limits the effectiveness of traditional IDSs that rely on payload inspection. ML-based IDSs have therefore emerged as promising solutions for OPC UA intrusion detection. However, these systems are typically trained under baseline conditions, an assumption that rarely holds in private 5G deployments where benign connectivity variations, such as UE reconnection procedures, PDU session resets, and temporary connectivity interruptions, may occur during normal operation. Although these events are not malicious, they can alter traffic patterns and potentially increase false positive rates (FPR). This work investigates the impact of benign connectivity variations on ML-based IDS outputs for encrypted OPC UA traffic in the absence of attacks. The results show that benign connectivity variations increase false positive activity and that elevated IDS anomaly scores frequently coincide with periods of CP activity. These findings highlight the importance of considering CP context when interpreting IDS outputs in industrial private 5G environments.

The remainder of this paper is organized as follows. Section 2 reviews related work, Sections 3 and 4 describe the methodology and experimental setup, Section 5 presents the evaluation results, and Section 6 concludes the paper and outlines future work.

2 Related Work↩︎

Monitoring approaches for encrypted OPC UA increasingly rely on observable metadata and traffic characteristics rather than decrypted payloads [2]. ML-based intrusion detection for encrypted traffic has been widely studied using statistical, timing, and flow-level features as alternatives to deep packet inspection [3]. Recent work further demonstrated effective detection of OPC UA-specific attacks in industrial private 5G networks using ML techniques [4]. Related studies have also investigated anomaly detection in 5G infrastructures using network telemetry and CP information [5], [6], while concept drift and contextual factors have been identified as important challenges for reliable IDS operation [7], [8]. However, the interaction between benign connectivity variations in private 5G networks, encrypted OPC UA traffic, and IDS false positive behavior remains insufficiently understood. To address this gap, this paper analyzes the relationship between CP activity and IDS outputs under benign connectivity variation scenarios.

3 Proposed Methodology↩︎

3.1 Experimental Workflow↩︎

All OPC UA communication is protected using the SignAndEncrypt security mode, preventing payload inspection and requiring intrusion detection to rely on payload-agnostic traffic characteristics. Encrypted OPC UA traffic observed at the user plane (UP) is segmented into consecutive 5 s time windows (TWs) and transformed into statistical feature vectors that serve as input to the ML-based IDS. The system is trained using encrypted OPC UA traffic collected under baseline conditions and subsequently evaluated under controlled benign connectivity variation scenarios to analyze their impact on the FPR. In parallel, UE-level CP signaling traffic is captured and processed to extract lightweight CP indicators. Although not used as IDS inputs, these indicators are aggregated over the same TWs and aligned with IDS outputs to enable a joint analysis of IDS behavior and CP activity under benign connectivity variation scenarios.

3.2 Statistical Features from Encrypted OPC UA Traffic↩︎

Within each TW, bidirectional OPC UA flows are identified and processed independently. Flow-level observations are subsequently aggregated across all active flows within the TW to construct a single feature vector representing the overall communication behavior during the observation interval. Statistical features are extracted to characterize transport behavior, temporal dynamics, and OPC UA lifecycle activity. Transport features describe traffic volume, directionality, asymmetry, packet characteristics, and flow dominance, while temporal features characterize communication rate, timing, duration, variability, activity, entropy, and flow-level dynamics. Observable OPC UA framing metadata, such as message chunking characteristics and secure channel establishment or closure events, is incorporated to represent lifecycle-related protocol behavior despite payload encryption. The selected feature categories are adapted from OPC UA intrusion detection features reported in prior work [4], retaining only those observable under the SignAndEncrypt security mode.

3.3 Control-Plane Context Indicators↩︎

To provide CP context for the analyzed benign connectivity variation scenarios, a set of lightweight CP indicators is extracted from UE-level signaling traces containing Non-Access Stratum (NAS) and Next Generation Application Protocol (NGAP) messages, as summarized in Table ¿tbl:tab:cp95context?. The indicators capture connectivity-related activity observable at the CP, including registration procedures, Connection Management (CM) state transitions, Protocol Data Unit (PDU) session events, and overall CP signaling intensity. CP indicator values are aggregated across all observed UEs within each TW and temporally aligned with the corresponding UP traffic features and IDS outputs. This alignment enables a joint analysis of IDS outputs and CP activity under benign connectivity variation scenarios.

4 Implementation↩︎

4.1 Experimental Environment↩︎

The experimental evaluation is conducted within the industrial testbed presented in [9], which incorporates a 3GPP Release 16 compliant private 5G Standalone network, a UP traffic mirroring infrastructure, and an IDS evaluation platform. The OPC UA traffic generation setup is based on the industrial application environment described in [4], with all OPC UA communication protected using the SignAndEncrypt security mode. The environment includes multiple OPC UA endpoints representing controller, HMI, and supervisory communication roles, resulting in heterogeneous industrial communication patterns. The collected encrypted traffic is processed using the R&S®PACE 2 library for payload-agnostic traffic analysis and statistical feature extraction.

4.2 Attack Scenarios↩︎

The evaluation includes four protocol-compliant OPC UA attack scenarios: Persistent Secure Channel Exhaustion (PSCE), Publish Request Flooding (PRF), Browse Address Space (BAS), and Translate Browse Path (TBP), representing resource exhaustion, excessive service invocation, recursive information model traversal, and complexity-driven service abuse, respectively. For each attack scenario, three operational configurations, denoted as Level 1 (L1), Level 2 (L2), and Level 3 (L3), are defined to represent different attack intensities. L1 corresponds to the highest attack intensity, whereas L3 represents a lower-intensity attack variant that generates communication patterns more similar to normal OPC UA operation. L2 provides an intermediate operating point between these two extremes. All attack scenarios are implemented by extending Claroty’s OPC UA exploitation framework [10] to support OPC UA communication protected by the SignAndEncrypt security mode.

4.3 Benign Connectivity Variation Scenarios↩︎

To evaluate the impact of benign connectivity variations on encrypted OPC UA intrusion detection in private 5G networks, a set of connectivity variation scenarios is introduced, including hard and soft UE reconnection procedures as well as PDU session reset and interruption events, as summarized in Table 1. These scenarios reflect plausible connectivity events arising from legitimate industrial network operation that may temporarily modify communication patterns and alter encrypted traffic behavior without representing malicious activity, thereby potentially affecting IDS outputs and FPR. To assess intrusion detection robustness under realistic deployments, the connectivity variation scenarios are excluded from model training and used solely during evaluation.

4.4 Dataset Construction↩︎

The dataset comprises encrypted OPC UA traffic collected under baseline conditions, benign connectivity variation scenarios, and malicious attack scenarios. All traffic traces are stored as Packet Capture (PCAP) files with a duration of approximately 10 minutes. The dataset contains 90 baseline PCAP files, 40 PCAP files collected under benign connectivity variation scenarios, and 120 malicious PCAP files generated from four OPC UA attack types. Each benign connectivity variation scenario comprises ten PCAP files, with two executions of the event per PCAP. Each attack type is implemented under three operational configurations, with ten PCAP files collected per level. For ML-based IDS development, baseline and malicious traffic are partitioned at the capture level into training, validation, and test sets. Baseline PCAP files are divided into 63 training, 9 validation, and 18 test files. Malicious PCAP files are divided into 60 training, 24 validation, and 36 test files while preserving attack configuration distributions.

4.5 Machine Learning Models↩︎

Intrusion detection is formulated as a supervised binary classification problem distinguishing benign from malicious encrypted OPC UA traffic behavior. Four supervised ML models are evaluated: Logistic Regression (LogReg), Random Forests (RF), Support Vector Machines with radial basis function kernels (SVM), and Extreme Gradient Boosting (XGBoost). Hyperparameter tuning is performed using grid search with GroupKFold cross-validation on the training set. The decision threshold is selected on the validation set by maximizing the \(F_1\)-score while constraining the baseline FPR to 5%. Final performance is evaluated on the test set. Recall is used to assess intrusion detection performance, while FPR quantifies the impact of benign connectivity variation scenarios.

5 Evaluation Results↩︎

5.1 Detection Performance↩︎

Table 2 summarizes the recall achieved by the evaluated ML-based IDS models for the considered OPC UA attack scenarios and operational configurations under encrypted OPC UA communication. All evaluated models achieve high recall for the highest-intensity attack configurations, demonstrating that malicious activity remains detectable even when OPC UA payloads are protected using the SignAndEncrypt security mode. Recall decreases progressively as attack intensity is reduced from L1 to L3. This trend reflects the attack design, as lower-intensity configurations produce less pronounced changes in the encrypted OPC UA traffic characteristics, resulting in a more challenging classification task. The decrease in recall is particularly evident for BAS, PSCE, and TBP, whose L3 recall values remain below 0.46 even for the best-performing model. In contrast, PRF remains comparatively easier to detect, with XGBoost achieving a recall of 0.674 for the L3 configuration.

5.2 Impact of Benign Connectivity Variations↩︎

To evaluate the impact of benign connectivity variations on false positive activity, the trained models are evaluated on both the baseline test subset and the benign connectivity variation dataset. The resulting FPRs are shown in Fig. 1. Under benign connectivity variation scenarios, all evaluated ML-based IDS models exhibit higher FPR values, increasing from 3.53%–4.88% under baseline conditions to 8.02%–9.15%. These results indicate that benign connectivity variations can substantially influence IDS outputs despite the absence of malicious traffic. Furthermore, the comparable FPR increase observed across all four evaluated model families suggests that the phenomenon is largely systematic rather than specific to a particular classifier architecture or learning paradigm.

5.3 Control-Plane Events and False Positive Activity↩︎

To investigate the relationship between benign connectivity events and IDS outputs, CP-active TWs are compared with IDS anomaly scores. As XGBoost achieves the highest overall recall in Table 2, it is selected for the subsequent analysis. Fig. 2 illustrates the temporal relationship between CP-active TWs and IDS anomaly scores using four representative recordings, one from each benign connectivity variation scenario summarized in Table 1. A CP-active TW is defined as a 5 s TW in which at least one of the CP indicators listed in Table ¿tbl:tab:cp95context? is observed. Across all four scenarios, CP-active TWs are concentrated within three distinct phases. The first phase occurs near the beginning of each recording and is associated with normal network operation and UE activity. The remaining two phases correspond to the two controlled executions of the corresponding connectivity variation scenario.

For all four scenarios, IDS anomaly scores frequently increase within or shortly after the identified CP-active phases. In many cases, the anomaly score exceeds the decision threshold during these phases, indicating a temporal association between false positive detections and benign connectivity events. This behavior is observed across all evaluated benign connectivity variation scenarios. At the same time, occasional threshold crossings can also be observed outside the identified CP-active phases. This observation is consistent with the non-zero baseline FPR reported in Fig. 1, indicating that not all false positive detections are associated with CP activity.

6 Conclusion and Future Work↩︎

This paper investigated the impact of benign connectivity variations on ML-based IDS for encrypted OPC UA traffic in private 5G networks. Experimental results showed that the evaluated ML models maintain reasonable detection performance under encrypted communication. However, benign connectivity variations substantially increased the FPR across all evaluated models despite the absence of malicious traffic. Furthermore, temporal analysis revealed that elevated IDS anomaly scores often occur during or shortly after CP-active TWs associated with benign connectivity events. These findings suggest that benign connectivity variations should be considered when designing and deploying ML-based IDSs in industrial private 5G environments.

Future work will investigate CP-aware intrusion detection approaches that combine encrypted traffic features with CP context information to improve robustness against benign connectivity variations and reduce false positive activity.

Acknowledgment↩︎

The authors would like to thank K. Singh, J. Jockram, F. Mueller, ipoque GmbH, Deutsche Telekom, and Ericsson for their continuous support and valuable cooperation throughout this work.

Funding↩︎

This research is funded by dtec.bw – Digitalization and Technology Research Center of the Bundeswehr. dtec.bw is funded by the European Union – NextGenerationEU (project “Digital Sensor-2-Cloud Campus Platform” (DS2CCP), https://dtecbw.de/home/forschung/hsu/projekt-ds2ccp).

References↩︎