An Experimental Study of Machine Learning-Based Intrusion Detection for OPC UA over Industrial Private 5G Networks

Dominik Merli; Florian Foerster; Gerd Scholl; Henry Beuster; Kunal Singh; Song Son Ha; Tim Kittel

REVIEW 3 major objections 5 minor 32 references

An Experimental Study of Machine Learning-Based Intrusion Detection for OPC UA over Industrial Private 5G Networks

T0 review · 3 major / 5 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Supervised machine-learning models trained on protocol-aware windowed traffic features separate benign from malicious OPC UA traffic over a live private 5G network.

desk verdict Useful feasibility study of ML-based IDS for OPC UA over private 5G, but the PCAP-level split leaks attack parameter configurations into the test set, so the high F1 scores are likely optimistic. read the letter →

arxiv 2603.23416 v1 pith:VWSZKZBM submitted 2026-03-24 cs.CR

Song Son Ha , Kunal Singh , Florian Foerster , Henry Beuster , Tim Kittel , Dominik Merli , Gerd Scholl This is my paper · ORCID

classification cs.CR

keywords OPCUAintrusiondetectionprivate5Gmachinelearningindustrialcontrolsystemsprotocol-awarefeaturesnetworksecuritydenialofservice

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to show that ML-based intrusion detection can work for OPC UA industrial traffic carried over a private 5G network, a combination that mixes a stateful application protocol with wireless timing variability. The authors built an automation testbed on a commercial standalone 5G network, ran nine OPC UA-specific attack scenarios in three families (transport/session flooding, service-invocation flooding, and low-rate complexity-driven abuse), and extracted two layers of statistical features over fixed five-second windows. Supervised classifiers, especially gradient boosting, reached high F1 scores (a combined measure of precision and recall) for nearly every attack class while keeping benign traffic classifications above 0.97. The claim matters because factories are moving toward OPC UA over private 5G, and existing IDS results mostly come from wired or generic mobile traffic. If correct, protocol-aware features can catch low-rate semantic attacks that volume-based detectors miss.

What carries the argument

The load-bearing mechanism is a two-stage feature-extraction pipeline over fixed five-second windows. First, per-flow statistics are computed: packet counts and sizes, inter-arrival times, active flow durations, OPC UA service request/response counts, secure-channel and session lifecycle events, and subscription activity. Second, these are aggregated across all flows into window-level and cross-flow features—ratios, churn counts, flow-dominance measures, and the entropy of the service request distribution. That fixed-window, protocol-aware vector is what each supervised classifier sees. The attack suite is the second key piece: nine parameterized OPC UA-specific scenarios, from high-rate hel

What would settle it

Train the identical feature pipeline and models on OPC UA traffic from a second private 5G network (different vendor, release, or cell configuration) or with OPC UA SignAndEncrypt enabled, and compare per-class F1 to Table 4; a large drop on the low-rate complexity attacks—or a rise in benign false alarms above the reported ~0.97–0.99 baseline—would refute the generalization claim. A cheaper test is to rerun the same attacks with random burst/idle periods instead of the fixed 3s/7s cycle: if classifiers trained on the fixed cadence lose detection, then the reported success depends partly on th

Watch

Extended reading notes

Core claim

The central claim is that a supervised ML-based IDS using protocol-aware statistical features reliably detects representative OPC UA attacks in traffic captured at the user-plane interface of an operational private 5G network. Nine attack scenarios across three groups—transport/session flooding, service invocation flooding, and complexity-driven service abuse—were executed together with benign automation traffic, all using burst-idle patterns. Flow-level and cross-flow features aggregated over fixed 5-second windows let boosting-based models reach F1 scores of 0.91 or higher on nearly all tested classes, including low-rate semantic attacks that linear and bagging classifiers find harder. The

Load-bearing premise

The load-bearing premise is that traffic captured from this one commercial standalone 5G network, under unencrypted OPC UA and one warehouse-automation workload, represents industrial OPC UA-over-5G deployments generally; if a different scheduler, cell load, latency profile, security profile, or application pattern shifts the feature statistics enough, the reported F1 scores will not transfer.

Editorial extensions

If this is right

If the claim holds, factories can deploy protocol-aware ML IDS at the 5G user-plane interface without waiting for wired-to-wireless convergence; OPC UA attacks are detectable on a live standalone private 5G network.
High benign F1 (0.97–0.99) means false-alarm rates are low enough that an operator could tolerate the IDS in an always-on monitoring role, not just in offline analysis.
Boosting-based models are the safer choice when low-rate complexity attacks are in scope; linear and bagging baselines lose performance exactly on that class.
Because the PCAP-level split prevents windows from the same capture appearing in both training and test sets, the reported scores are not inflated by temporal leakage.
The finding that private 5G timing variability does not degrade detection supports extending the same feature design to other wireless industrial links, as long as protocol-aware rather than absolute timing features are used.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The evaluation is explicitly scoped to unencrypted OPC UA; applying the same pipeline to SignAndEncrypt traffic would require decryption or a different feature set, so the result does not yet cover the security profiles that many production systems are expected to use.
The fixed 3s-on/7s-off attack pattern, combined with fixed 5-second feature windows, means an adversary who randomizes burst timing or stretches attacks below the window resolution could plausibly evade the aggregated features; adaptive windowing is a natural test.
A direct transfer experiment—train on wired Ethernet OPC UA traffic and test on private 5G traffic, and the reverse—would quantify how much of the feature distribution is wireless-specific; the paper lists this as future work but does not run it.
The same windowed, protocol-aware feature recipe could be lifted to other stateful industrial protocols (for example Modbus TCP over private 5G), with the per-flow service counters replaced by protocol-specific operations.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Useful feasibility study, but the evaluation split lets the model peek at attack parameter configurations in the test set, so the headline F1 scores are likely optimistic.

What's genuinely new: the combination of OPC UA service semantics, private 5G traffic, and ML-based detection, evaluated on a real Ericsson standalone 5G testbed. The attack scenarios are well chosen—flooding at transport/session/service layers plus low-rate complexity abuse—and the feature set goes beyond simple packet statistics with lifecycle and cross-flow aggregations. The paper also correctly reports per-class F1 and does a PCAP-level split to avoid temporal leakage within captures. That part is sound.

The biggest problem is the split granularity. Each attack scenario has three parameter configurations, and each configuration is run three times (3, 6, 9 minutes). Splitting at the PCAP level means runs of the same configuration almost certainly land in both training and test. Those runs differ only in duration, so the test set contains near-duplicates of training attacks. The model can memorize a specific parameterization—say, READ-EXP with NodesToRead=64 at 5 req/s—rather than learn the attack class generally. That inflates F1, particularly for the low-rate complexity-driven scenarios in G3, which are exactly the ones that matter for demonstrating protocol-aware detection. The paper says the split prevents traffic leakage, but it does not prevent configuration leakage. This needs to be fixed, either by splitting at the configuration level or by leaving one configuration out entirely.

Other issues are secondary but worth naming: no error bars or significance tests across the three runs; no comparison to a standard IDS or feature set; a proprietary DPI library; and a single network. The unencrypted traffic is a deliberate limitation, stated honestly, but it still means the results don't speak to encrypted OPC UA. The testbed itself is a real asset, and the paper is clearly written.

I think the central feasibility claim is plausible. Protocol-aware features plus supervised ML should be able to separate these attacks from benign traffic, even with 5G timing variability. But the numbers as reported are not trustworthy until the config-level leakage is addressed. This deserves a serious referee—with major revision—because the testbed and feature engineering are valuable and the fix is straightforward.

Referee Report

3 major / 5 minor

Summary. This paper reports an experimental evaluation of a supervised ML-based intrusion detection system for OPC UA traffic transmitted over a private 5G network. The authors built a testbed with a Factory I/O warehouse simulation, OPC UA servers/clients, and an Ericsson private 5G network; generated benign traffic and nine attack scenarios grouped into transport/session flooding, service flooding, and complexity-driven abuse; extracted flow- and protocol-aware features over 5 s windows; and trained six classifiers. Performance is reported as per-class F1 scores on a held-out test set. The central claim is that the proposed IDS achieves high detection performance across these attack classes, including low-rate semantic attacks, and is robust to timing variability introduced by private 5G.

Significance. If the evaluation is valid, the paper makes a useful empirical contribution: it demonstrates a concrete OPC UA-specific IDS pipeline over an operational private 5G network, with protocol-aware features and multiple attack classes, where many prior studies use wired networks or synthetic data. It is also careful to use PCAP-level splitting to avoid temporal leakage and evaluates multiple model families. However, the validity of the headline F1 scores depends on whether the train/test split is independent at the attack-configuration level; the current description does not establish this. There is also no variance reporting or comparison to existing IDS baselines. These gaps currently prevent the results from being fully assessed.

major comments (3)

[§5.5] The PCAP-level split does not control for attack configuration leakage. With 9 PCAPs per attack (3 parameter configurations × 3 runs of 3/6/9 min), the 61/10/20 split of 91 PCAPs will, under random assignment, place most parameter configurations in more than one split: the probability that all three runs of a given configuration end up in the same split is only about 0.31. Since runs of the same configuration differ only in duration, test-set windows can be near-duplicates of training-set windows. The reported F1 values in Table 4, especially for low-rate scenarios such as READ-EXP, NESTED, and TBP, may then reflect memorization of parameterized attack signatures rather than detection of the attack class. Please (i) state whether the split was stratified so that no parameter configuration appears in both training and test, and (ii) if not, re-evaluate with configuration-exclusive splits
[§6 / Table 4] No measure of variability is reported. Each attack configuration was executed three times, but the three runs are treated as separate PCAPs in the split and no per-run or per-configuration F1 ranges, confidence intervals, or significance tests are given. Given that the differences between some models are small (e.g., OMSC ranges 0.970–0.976; CHUNK-F ranges 0.846–0.960), the ranking of models and the claim that boosting-based models are most stable require statistical support. The paper also does not report the number of test windows per class or class balance, which is essential for interpreting per-class F1 values under the stated imbalance.
[§6.3] The broader conclusion that 'private 5G does not inherently hinder ML-based IDS' is based on a single network configuration (one Ericsson Release 16 deployment, 3.7–3.8 GHz, one application workload). No evidence is provided for other scheduling algorithms, cell loads, security profiles, or radio conditions. The abstract is more modest and consistent with the data, but Section 6.3 overgeneralizes. Either temper the claim or add sensitivity analysis.

minor comments (5)

[§5.5] Typo: 'V oting' should be 'Voting'. Also in Table 4, the number of decimal places is inconsistent and the use of bold/plain formatting is not explained.
[§5.3] The text says 'three parameter configurations ... each executed in three runs of approximately 3, 6, and 9 minutes' and then says this yields 'significantly different temporal, volumetric, and semantic traffic characteristics within the same attack class.' Clarify that the differences are due to the parameterization, not the run duration.
[§5.4.2 / Table 3] The feature gl_service_entropy is described as 'Shannon entropy of OPC UA service request distribution' but the formula or the set of symbols over which entropy is computed is not given. This affects reproducibility.
[§5.5] No reproducibility statement is provided. Releasing feature vectors, anonymized PCAPs, or code would substantially strengthen the paper.
[§6] The paper does not compare against a simple baseline (e.g., threshold-based traffic volume detector or a standard flow-level ML IDS). Such a baseline would help isolate the contribution of protocol-aware features.

Circularity Check

0 steps flagged · score 2.0 of 10

No load-bearing circularity: the detection claims are empirical results on a held-out split, with only a minor non-load-bearing self-citation.

full rationale

The paper's central claim is an empirical result: supervised models are trained on labeled OPC UA traffic captured from a private 5G testbed, and their F1 scores are reported on a held-out PCAP-level split. This is a standard training/validation/test chain, not a derivation in which a predicted quantity is defined as a fitted input. The feature set is clearly attack-informed (e.g., SecureChannel open/close counters for OMSC, service counters for repeated Read/Write), but this does not make the evaluation circular: the benign/malicious labels come from independently executed experimental runs, and the ML models must still separate the classes on unseen captures. The only self-citation is Section 4.2, where the architecture 'builds upon a conceptual design introduced in [29]'; this is design provenance, not a load-bearing justification for the performance result. The skeptic's concern about PCAP-level splitting—same attack parameter configuration may appear in both training and test because each configuration is executed three times and captures are split at PCAP granularity—is a plausible test-set leakage limitation that could inflate F1 scores, but it is not a circularity by construction: no equation or fitted parameter is renamed as a prediction. It is an evaluation-independence validity concern, which belongs under correctness risk rather than circularity. Overall, no step in the paper reduces the reported detection performance to its own inputs by definition.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the representativeness of the testbed, the correctness of the proprietary DPI feature extraction, and the choice of attack implementations. The only fitted quantities are the ML model parameters and hyperparameters, which are standard for supervised learning.

free parameters (4)

Time window size (TW = 5 s) = 5 s
Features are aggregated over fixed 5-second windows; this value is chosen by the authors and not varied or justified. Different window sizes would likely change detection performance.
Supervised model parameters (LogReg coefficients, SVM support vectors, RF/GB/XGBoost ensemble weights, kNN neighbors) = unknown (not reported)
All classifiers are trained on the training split; the paper does not report the trained model parameters, only final F1 scores. These parameters are fitted to the training data and determine the classification output.
Hyperparameters (e.g., regularization, tree depths, number of estimators) = not reported
The validation split is used for hyperparameter selection in models supporting grid-search optimization (Section 5.5), but the selected values are not listed. These choices are fitted on the validation data and affect test performance.
Attack parameterizations (rates, durations, list sizes) = listed in Table 1 (e.g., 500–2000 HEL/s, 50–150 channels/s, 20–80 browse/s)
These were chosen by the authors to represent each attack class; they are not fitted to any external benchmark but shape the dataset and the reported detection difficulty.

assumptions (5)

domain assumption OPC UA traffic in the testbed, including the unencrypted SignAndEncrypt-disabled configuration, is representative of real industrial deployments.
Section 4.1 deliberately disables encryption; if real deployments use encryption, the IDS would need to operate on encrypted payloads, which the paper does not address.
domain assumption The Claroty opcua-exploitation framework attack implementations are representative of real-world OPC UA attacks.
Section 5.3 states attacks are built upon this framework; no independent validation that these match attacker behavior in production.
domain assumption The R&S PACE 2 DPI library correctly decodes OPC UA protocol fields and extracts the features used for classification.
The paper relies on this proprietary library for the t_ and gl_ features; incorrect parsing would invalidate all feature-based results.
standard math Standard supervised ML algorithms are appropriate for this detection task and their assumptions (e.g., i.i.d. windows after PCAP-level split) hold.
The paper uses common libraries; no proof of statistical guarantees beyond typical empirical evaluation.
domain assumption The private 5G network (Ericsson EDA V-Isolution, 3GPP Release 16, 3.7–3.8 GHz) is representative of industrial private 5G deployments and its timing variability is similar to other configurations.
Section 6.3 argues robustness to 5G timing variability based on this single network; other 5G deployments may have different scheduling, latency, and loss profiles.

how reviews work

0 comments

Cite this review

Pith. "Pith review of An Experimental Study of Machine Learning-Based Intrusion Detection for OPC UA over Industrial Private 5G Networks." pith.science (2026). https://pith.science/paper/VWSZKZBM

@misc{pith2026260323416,
  author       = {Pith},
  title        = {Pith review of: An Experimental Study of Machine Learning-Based Intrusion Detection for OPC UA over Industrial Private 5G Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VWSZKZBM}},
  note         = {Machine review of arXiv:2603.23416}
}

read the original abstract

Industrial deployments increasingly rely on Open Platform Communications Unified Architecture (OPC UA) as a secure and platform-independent communication protocol, while private Fifth Generation (5G) networks provide low-latency and high-reliability connectivity for modern automation systems. However, their combination introduces new attack surfaces and traffic characteristics that remain insufficiently understood, particularly with respect to machine learning-based intrusion detection systems (ML-based IDS). This paper presents an experimental study on detecting cyberattacks against OPC UA applications operating over an operational private 5G network. Multiple attack scenarios are executed, and OPC UA traffic is captured and enriched with statistical flow-, packet-, and protocol-aware features. Several supervised ML models are trained and evaluated to distinguish benign and malicious traffic. The results demonstrate that the proposed ML-based IDS achieves high detection performance for a representative set of OPC UA-specific attack scenarios over an operational private 5G network.

Figures

Figures reproduced from arXiv: 2603.23416 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 3 canonical work pages

[1]

Integration of 5g and opc ua for smart manufacturing of the future

Xiongfeng Zhang, Seonjo Lim, Changdae Lee, Won Seok Song, Yu Chul Kim, Mengmeng Yu, Se- ung Ho Hong, Nam Hyun Yoo, and Min Wei. Integration of 5g and opc ua for smart manufacturing of the future. In2023 IEEE/SICE International Symposium on System Integration (SII), pages 1–6, 2023. doi:10.1109/SII55687.2023.10039191

arXiv 2023
[2]

Private 5G: The Future of Industrial Wireless.IEEE Industrial Electronics Magazine, 14(4): 136–145, 2020

Adnan Aijaz. Private 5G: The Future of Industrial Wireless.IEEE Industrial Electronics Magazine, 14(4): 136–145, 2020

2020
[3]

5g security challenges and opportunities: A system approach

Ashutosh Dutta and Eman Hammad. 5g security challenges and opportunities: A system approach. In2020 IEEE 3rd 5G world forum (5GWF), pages 109–114. IEEE, 2020

2020
[4]

Easing the conscience with opc ua: an internet-wide study on insecure deployments

Markus Dahlmanns, Johannes Lohmöller, Ina Berenice Fink, Jan Pennekamp, Klaus Wehrle, and Martin Henze. Easing the conscience with opc ua: an internet-wide study on insecure deployments. InProceedings of the ACM Internet Measurement Conference, pages 101–110, 2020

2020
[5]

The Performance of OPC-UA Security Model at Field Device Level

Olli Post, Jari Seppälä, and Hannu Koivisto. The Performance of OPC-UA Security Model at Field Device Level. volume 2, pages 337–341, January 2009

2009
[6]

OPC UA Security Analysis, 2017

BSI. OPC UA Security Analysis, 2017. [Online]. Available: https://www.bsi.bund.de/SharedDocs/ Downloads/EN/BSI/Publications/Studies/OPCUA/OPCUA.html?nn=132646. Accessed: Mar. 26, 2025

2017
[7]

Opc ua security analysis.Federal Office for Information Security (BSI), 2022

Johannes vom Dorp, Sven Merschjohann, David Meier, Florian Patzer, Markus Karch, and Christian Haas. Opc ua security analysis.Federal Office for Information Security (BSI), 2022

2022
[8]

Simulating and Detecting Attacks of Untrusted Clients in OPC UA Networks

Charles Varlei Neu, Ina Schiering, and Avelino Zorzo. Simulating and Detecting Attacks of Untrusted Clients in OPC UA Networks. InProceedings of the Third Central European Cybersecurity Conference, CECC 2019, pages 1–6, New York, NY , USA, November 2019. Association for Computing Machinery. ISBN 9781450372961. doi:10.1145/3360664.3360675. URLhttps://dl.ac...

arXiv 2019

Show all 32 references

[9]

Assessing the Impact of Attacks on opc-ua Applications in the Industry 4.0 Era

Julien Polge, Jeremy Robert, and Yves Le Traon. Assessing the Impact of Attacks on opc-ua Applications in the Industry 4.0 Era. In2019 16th IEEE annual consumer communications & networking conference (CCNC), pages 1–6. IEEE, 2019

2019
[10]

Deep Learning-based Enhanced Security in Cyber- Physical Systems: A Multi-Attack Perspective

Sandeep Singh Bindra and Alankrita Aggarwal. Deep Learning-based Enhanced Security in Cyber- Physical Systems: A Multi-Attack Perspective. In2024 International Conference on Computational Intelligence and Com- puting Applications (ICCICA), volume 1, pages 347–352, May 2024. do...

2024
[11]

Research on network traffic identification based on machine learning and deep packet inspection

Bowen Yang and Dong Liu. Research on network traffic identification based on machine learning and deep packet inspection. In2019 IEEE 3rd Information Technology, Networking, Electronic and Automation Control Conference (ITNEC), pages 1887–1891, 2019. doi:10.1109/ITNEC.2019.8729153

2019
[12]

Ai-based network security enhancement for 5g industrial internet of things environments

Jonghoon Lee, Hyunjin Kim, Chulhee Park, Youngsoo Kim, and Jong-Geun Park. Ai-based network security enhancement for 5g industrial internet of things environments. In2022 13th International Conference on Information and Communication Technology Convergence (ICTC), pages 971–97...

2022
[13]

Role of machine learning and deep learning in securing 5g-driven industrial iot applications.Ad Hoc Networks, 123:102685, 2021

Parjanay Sharma, Siddhant Jain, Shashank Gupta, and Vinay Chamola. Role of machine learning and deep learning in securing 5g-driven industrial iot applications.Ad Hoc Networks, 123:102685, 2021

2021
[14]

Vet5g: A virtual end-to-end testbed for 5g network security experimentation

Zhixin Wen, Harsh Sanjay Pacherkar, and Guanhua Yan. Vet5g: A virtual end-to-end testbed for 5g network security experimentation. InProceedings of the 15th Workshop on Cyber Security Experimentation and Test, CSET ’22, page 19–29, New York, NY , USA, 2022. Association for Comp...

2022
[15]

An experimental testbed for 5g network security assessment

Karim Baccar and Abdelkader Lahmadi. An experimental testbed for 5g network security assessment. InNOMS 2023-2023 IEEE/IFIP Network Operations and Management Symposium, pages 1–6, 2023. doi:10.1109/NOMS56928.2023.10154283

2023
[16]

A 5g and beyond testbed for cybersecurity research and education

Ibrahim Almazyad, Safwan Elmadani, and Salim Hariri. A 5g and beyond testbed for cybersecurity research and education. 10 2024. 11 An Experimental Study of ML-Based IDS for OPC UA over Industrial Private 5G NetworksA PREPRINT

2024
[17]

A case study on the representativeness of public DoS network traffic data for cybersecurity research

Marta Catillo, Antonio Pecchia, Massimiliano Rak, and Umberto Villano. A case study on the representativeness of public DoS network traffic data for cybersecurity research. InProceedings of the 15th International Conference on Availability, Reliability and Security, ARES ’20, ...

2020
[18]

A Survey on Industrial Control System Testbeds and Datasets for Security Research.IEEE Communications Surveys & Tutorials, 23(4):2248–2294, 2021

Mauro Conti, Denis Donadel, and Federico Turrin. A Survey on Industrial Control System Testbeds and Datasets for Security Research.IEEE Communications Surveys & Tutorials, 23(4):2248–2294, 2021. ISSN 1553-877X. doi:10.1109/COMST.2021.3094360. URL https://ieeexplore-ieee-org.ez...

2021
[19]

Testing Commercial Intrusion Detection Systems for Industrial Control Systems in a Substation Hardware in the Loop Testlab

Jon-Martin Storm, Siv Hilde Houmb, Pallavi Kaliyar, Laszlo Erdodi, and Janne Merete Hagen. Testing Commercial Intrusion Detection Systems for Industrial Control Systems in a Substation Hardware in the Loop Testlab. Electronics, 13(1):60, January 2024. ISSN 2079-9292. doi:10.33...

2024 doi
[20]

A Review of Deep Learning IDS for DDoS Attacks in WLANs

Julius Silaa, Hippolyte Muyingi, and Attlee Gamundani. A Review of Deep Learning IDS for DDoS Attacks in WLANs. InProceedings of the International Conference on Data Science, Machine Learning and Artificial Intelligence, DSMLAI ’21’, pages 74–79, New York, NY , USA, January 20...

2022
[21]

Cyber security of OT networks: A tutorial and overview, February 2025

Harsh Vardhan Sumit Kumar. Cyber security of OT networks: A tutorial and overview, February 2025. URL http://arxiv.org/abs/2502.14017. arXiv:2502.14017 [cs]

2025 arXiv
[22]

It-ot integration challenges in utilities

Phani Kumar Garimella. It-ot integration challenges in utilities. In2018 IEEE 3rd International Conference on Computing, Communication and Security (ICCCS). IEEE, October 2018. doi:10.1109/cccs.2018.8586807

2018
[23]

September 2023

Keith Stouffer, Michael Pease, CheeYee Tang, Timothy Zimmerman, Victoria Pillitteri, Suzanne Lightman, Adam Hahn, Stephanie Saravia, Aslam Sherule, and Michael Thompson.Guide to Operational Technology (OT) security. September 2023. doi:10.6028/nist.sp.800-82r3

2023 doi
[24]

Licster – a low-cost ics security testbed for education and research

Felix Sauer, Matthias Niedermaier, Susanne Kießling, and Dominik Merli. Licster – a low-cost ics security testbed for education and research. InElectronic Workshops in Computing. BCS Learning and Development,
[25]

Creating a european scada security testbed

Henrik Christiansson and Eric Luiijf. Creating a european scada security testbed. In Eric Goetz and Sujeet Shenoi, editors,Critical Infrastructure Protection, pages 237–247, Boston, MA, 2008. Springer US. ISBN 978-0-387-75462-8

2008
[26]

OTG: A Gateway for Cybersecurity in the Context of OPC UA PubSub Pattern.Journal of Physics: Conference Series, 1693(1):012016, December 2020

Tianyu bu, Jiahao Liu, Jinfeng Huang, and Zhigang Sun. OTG: A Gateway for Cybersecurity in the Context of OPC UA PubSub Pattern.Journal of Physics: Conference Series, 1693(1):012016, December 2020. ISSN 1742-6596. doi:10.1088/1742-6596/1693/1/012016. URL https://dx.doi.org/10....

2020 doi
[27]

TR 21.916 version 16.2.0 Release 16

3GPP. TR 21.916 version 16.2.0 Release 16
[28]

5G NR Jam- ming, Spoofing, and Sniffing: Threat Assessment and Mitigation

Marc Lichtman, Raghunandan Rao, Vuk Marojevic, Jeffrey Reed, and Roger Piqueras Jover. 5G NR Jam- ming, Spoofing, and Sniffing: Threat Assessment and Mitigation. In2018 IEEE International Conference on Communications Workshops (ICC Workshops), pages 1–6, May 2018. doi:10.1109/...

2018
[29]

Testbed and Software Architecture for Enhancing Security in Industrial Private 5G Networks

Song Son Ha, Florian Foerster, Thomas Robert Doebbert, Tim Kittel, Dominik Merli, and Gerd Scholl. Testbed and Software Architecture for Enhancing Security in Industrial Private 5G Networks. In2025 IEEE 30th International Conference on Emerging Technologies and Factory Automat...

2025
[30]

Factory I/O: 3D factory simulation software

Real Games. Factory I/O: 3D factory simulation software. Software, 2026. URL https://factoryio.com/. Accessed: Jan. 2026

2026
[31]

Opc-ua exploitation framework

Claroty Team82. Opc-ua exploitation framework. Online repository, 2023. URL https://github.com/ claroty/opcua-exploit-framework. Accessed: Dec. 2025. 12

2023
[2019]

doi:10.14236/ewic/icscsr19.1

doi

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.

[1] [1]

Integration of 5g and opc ua for smart manufacturing of the future

Xiongfeng Zhang, Seonjo Lim, Changdae Lee, Won Seok Song, Yu Chul Kim, Mengmeng Yu, Se- ung Ho Hong, Nam Hyun Yoo, and Min Wei. Integration of 5g and opc ua for smart manufacturing of the future. In2023 IEEE/SICE International Symposium on System Integration (SII), pages 1–6, 2023. doi:10.1109/SII55687.2023.10039191

arXiv 2023

[2] [2]

Private 5G: The Future of Industrial Wireless.IEEE Industrial Electronics Magazine, 14(4): 136–145, 2020

Adnan Aijaz. Private 5G: The Future of Industrial Wireless.IEEE Industrial Electronics Magazine, 14(4): 136–145, 2020

2020

[3] [3]

5g security challenges and opportunities: A system approach

Ashutosh Dutta and Eman Hammad. 5g security challenges and opportunities: A system approach. In2020 IEEE 3rd 5G world forum (5GWF), pages 109–114. IEEE, 2020

2020

[4] [4]

Easing the conscience with opc ua: an internet-wide study on insecure deployments

Markus Dahlmanns, Johannes Lohmöller, Ina Berenice Fink, Jan Pennekamp, Klaus Wehrle, and Martin Henze. Easing the conscience with opc ua: an internet-wide study on insecure deployments. InProceedings of the ACM Internet Measurement Conference, pages 101–110, 2020

2020

[5] [5]

The Performance of OPC-UA Security Model at Field Device Level

Olli Post, Jari Seppälä, and Hannu Koivisto. The Performance of OPC-UA Security Model at Field Device Level. volume 2, pages 337–341, January 2009

2009

[6] [6]

OPC UA Security Analysis, 2017

BSI. OPC UA Security Analysis, 2017. [Online]. Available: https://www.bsi.bund.de/SharedDocs/ Downloads/EN/BSI/Publications/Studies/OPCUA/OPCUA.html?nn=132646. Accessed: Mar. 26, 2025

2017

[7] [7]

Opc ua security analysis.Federal Office for Information Security (BSI), 2022

Johannes vom Dorp, Sven Merschjohann, David Meier, Florian Patzer, Markus Karch, and Christian Haas. Opc ua security analysis.Federal Office for Information Security (BSI), 2022

2022

[8] [8]

Simulating and Detecting Attacks of Untrusted Clients in OPC UA Networks

Charles Varlei Neu, Ina Schiering, and Avelino Zorzo. Simulating and Detecting Attacks of Untrusted Clients in OPC UA Networks. InProceedings of the Third Central European Cybersecurity Conference, CECC 2019, pages 1–6, New York, NY , USA, November 2019. Association for Computing Machinery. ISBN 9781450372961. doi:10.1145/3360664.3360675. URLhttps://dl.ac...

arXiv 2019