Industrial deployments increasingly rely on Open Platform Communications Unified Architecture (OPC UA) as a secure and platform-independent communication protocol, while private Fifth Generation (5G) networks provide low-latency and high-reliability connectivity for modern automation systems. However, their combination introduces new attack surfaces and traffic characteristics that remain insufficiently understood, particularly with respect to machine learning-based intrusion detection systems (ML-based IDS). This paper presents an experimental study on detecting cyberattacks against OPC UA applications operating over an operational private 5G network. Multiple attack scenarios are executed, and OPC UA traffic is captured and enriched with statistical flow-, packet-, and protocol-aware features. Several supervised ML models are trained and evaluated to distinguish benign and malicious traffic. The results demonstrate that the proposed ML-based IDS achieves high detection performance for a representative set of OPC UA-specific attack scenarios over an operational private 5G network.

翻译：工业部署日益依赖开放平台通信统一架构（OPC UA）作为安全且平台无关的通信协议，同时私有第五代（5G）网络为现代自动化系统提供低延迟和高可靠性连接。然而，两者的结合引入了新的攻击面和流量特征，这些特征尚未得到充分理解，特别是在基于机器学习的入侵检测系统方面。本文针对运行在私有5G网络上的OPC UA应用，开展了网络攻击检测的实验研究。我们执行了多种攻击场景，捕获OPC UA流量，并利用统计流特征、包特征及协议感知特征进行增强。训练并评估了多种监督式机器学习模型，以区分良性流量与恶意流量。结果表明，在运行的私有5G网络上，所提出的基于机器学习的入侵检测系统针对一组具有代表性的OPC UA特定攻击场景实现了高检测性能。