industrial network engineers

Abstract: Deterministic industrial networks often present an operational trade-off between maintaining microsecond timing of primary control loops and capturing security telemetry. This work investigates the engineering feasibility of the Operational Technology Supervisor (OTSV), a three-tier passive monitoring framework designed to resolve this visibility challenge within timing-sensitive grid-edge infrastructure. By utilizing a Layer-3-unconfigured passive ingestion mode on bare-metal hardware via a physical switched port analyzer (SPAN) loop, the deep packet inspection engine is isolated from the production network, implementing a software-enforced unidirectional export policy. Performance validation conducted over a continuous audit comprising 32,927 active-monitoring round-trip time (RTT) samples yielded stable latency distributions across a laboratory power-monitoring loop running Modbus TCP and IEC 61850 MMS protocols. The measured latency delta between the unmonitored baseline and the active monitoring state was less than 0.12 milliseconds, supporting the feasibility of continuous high-fidelity security observation alongside stringent grid-edge metering timing bounds without measurably degrading the monitored reporting path.

Abstract: Recent advancements in the fields of industrial automation and in-vehicle communication have also increased the requirements on their underlying networks. Traditional field bus technologies are being replaced by regular Ethernet devices with features from the IEEE Time-Sensitive Networking working group. Their standards are designed to achieve zero congestion loss and deterministic latency bounds, but the specific guarantees can differ depending on the shapers used and how the bounds are calculated. After several contributions to the standardization efforts, this work presents a number of decentralized latency models that can be applied locally on the switches, without requiring global knowledge from the rest of the network. It includes a formal definition of delay segments that allows to incorporate interoperability between different shapers and latency models in the future. It presents pseudo-code suggestions for the latency bounds computation of Strict Priority, Credit-Based Shaping, Asynchronous Traffic Shaping, and Cyclic Queuing and Forwarding, all of which can be applied locally on the devices. Finally, five models were implemented and evaluated with respect to their efficiency in terms of latency, jitter, and number of accepted streams. The results illustrate how different shapers are suited for different networks and traffic distributions.

Abstract: Machine learning-based intrusion detection systems (IDS) are critical for securing Industrial Internet of Things (IIoT) environments. Most adversarial research against them perturbs the feature vector or the traffic that produces it, and depends on gradient access, repeated model queries, or a learned model of benign traffic. A smaller line of work reshapes packet timing without querying the detector, but makes malicious traffic mimic a learned model of benign timing. Across these approaches, one assumption of industrial monitoring pipelines has received little attention: temporal synchronization. An IDS reconstructs operational state by aggregating telemetry into sliding or tumbling windows, so its view depends not only on what is observed but on when each observation falls relative to a window boundary. We introduce the Phantom State Attack (PSA), which exploits that dependence under a passive, zero-query threat model. Rather than modifying packets, perturbing features, querying the classifier, or fitting any model of benign traffic, PSA injects bounded timing drift calibrated to the attack flow's own inter-arrival variability, moving observations across the nearest window boundary by the minimal shift needed. The IDS then reconstructs a phantom state that diverges from the true process state. We evaluate PSA on ToN-IoT and CIC IIoT 2025 (DataSense), against Random Forest, MLP and XGBoost, measuring detection degradation, synchronization distortion, stealth, and attacker cost. PSA degrades detection on flows carrying enough packets for window-boundary redistribution, and leaves others almost unchanged, so its effect is conditional. A query-based baseline reaches higher raw success but needs many queries per window, while PSA needs none. The results identify temporal aggregation as an attack surface reachable under weaker assumptions than prior evasion techniques.

Abstract: Private 5G networks are a key enabler for flexible industrial automation, especially when used in conjunction with Time-Sensitive Networking (TSN) technology. In this context, radio schedulers must multiplex safety-critical control traffic with bandwidth-hungry sensing streams over a fixed spectrum allocation. This paper proposes a Head-of-Line (HoL) Enhanced Hybrid Lyapunov scheduler for 5G-TSN networks that augments a drift-plus-penalty queue-stability core with an explicit head-of-line delay term and a class-isolation mechanism. The scheduler is evaluated in a 3GPP Indoor Factory scenario with standardized 3GPP fading, spatial consistency, and clutter blockage, using Automated Guided Vehicles (AGVs) generating concurrent URLLC, eMBB, and mMTC flows mapped to dedicated QoS-flow bearers. A fleet-size sweep of 5--30 AGVs on a fixed 20\,MHz carrier reveals a scheduler-independent capacity threshold at approximately 12 vehicles, verified by resource-block saturation. Below the threshold, the proposed scheduler is competitive with the strongest delay-aware baselines and its head-of-line term halves the URLLC deadline-miss ratio relative to the plain Lyapunov formulation. Beyond the threshold, it degrades selectively where the baselines collapse: at $2.5\times$ overload it delivers $1.8\times$ more URLLC traffic than the proportional-fair and delay-budget-aware baselines with a $\approx 4$--$7\times$ shorter 99th-percentile latency, resolving the capacity shortfall in favour of the critical classes instead of spreading it across the traffic mix, at a quantified cost in aggregate cell throughput. The results position Lyapunov-based scheduling as an attractive overload-robustness mechanism for industrial 5G deployments that must remain dependable under unexpected load conditions.