AI summaryⓘ
The authors studied how well intrusion detection systems (IDS) can spot attacks in encrypted OPC UA communication, which hides much of the message content. They created a framework to measure how much structural information remains visible and how this relates to the IDS's ability to detect attacks. Their framework uses scores and statistical measures to analyze patterns in network data and compares detection results across different attack types. They found that while their Structural Leakage Score (SLS) matches detection trends within similar attacks, it doesn't fully explain differences between different attack families. Overall, their work helps connect what the IDS can detect to the leftover visible signals in encrypted traffic.
OPC UAencryptionintrusion detection system (IDS)Structural Leakage Score (SLS)Jensen-Shannon divergencetransport layertemporal analysisprotocol lifecyclemachine learningnetwork security
Authors
Song Son Ha, Florian Foerster, Henry Beuster, Eduard Zeller, Dominik Merli, Gerd Scholl
Abstract
OPC Unified Architecture (OPC UA) encryption conceals application-layer semantics and restricts intrusion detection to residual communication structure. Although machine learning-based intrusion detection systems (IDSs) can detect attacks in encrypted OPC UA traffic, the relationship between residual structural observability and attack detectability remains insufficiently understood. This paper presents an explanatory framework combining a structural observability profile, the Structural Leakage Score (SLS), controlled within-family and cross-family comparisons, phase-specific analysis, and dimension-ablation analysis. Jensen--Shannon divergence is used to characterize transport, temporal, and protocol-lifecycle dimensions, while the SLS summarizes the residual structural magnitude. Evaluation on an industrial private 5G testbed covers four attack families with progressively reduced nominal activity. SLS generally tracks within-family recall trends but does not reproduce cross-family detectability ordering. Interpreting these mismatches also requires temporal prevalence, inter-burst persistence, predictive utility, unique contribution, and redundancy. The framework complements conventional IDS metrics by relating detection outcomes to the magnitude, temporal distribution, and predictive role of observable structural evidence.