Residual Observability and Attack Detectability in Encrypted OPC UA Traffic

arXiv:2607.17809 · cs.CR · Submitted 2026-07-20 · Read on arXiv

Song Son Ha, Florian Foerster, Henry Beuster, Eduard Zeller, Dominik Merli, Gerd Scholl

cs.CR

Submitted: 2026-07-20

Comments: 13 pages, 5 figures. Accepted for presentation at the 52nd Annual Conference of the IEEE Industrial Electronics Society (IECON 2026), Doha, Qatar, October 18--21, 2026

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Ablation — 11× in this paper · explained in 1 episode
• Redundancy — 10× in this paper · explained in 2 episodes
• AUROC — 3× in this paper · explained in 2 episodes
• Conference on Emerging Technologies and Factory Automation — 2× in this paper
• Model-Agnostic — 2× in this paper · explained in 2 episodes
• Structural Leakage Score — 2× in this paper
• Aggregation — 1× in this paper · explained in 1 episode
• Cooperation — 1× in this paper · explained in 2 episodes
• Explainability — 1× in this paper · explained in 3 episodes
• Feature Extraction — 1× in this paper · explained in 2 episodes
• Jensen–Shannon Divergence (JSD) — 1× in this paper · explained in 2 episodes
• Random Forest — 1× in this paper
• Support Vector Machine — 1× in this paper

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs