AI 中文总结
研究加密OPC UA流量中残余结构可观测性与攻击可检测性的关系，提出结合结构可观测性概况等的解释框架，用Jensen-Shannon散度和SLS表征相关维度与大小，在工业5G测试平台评估，补充传统IDS指标。
AI 中文摘要
OPC统一架构（OPC UA）加密隐藏了应用层语义，并将入侵检测限制在残余通信结构上。尽管基于机器学习的入侵检测系统（IDS）可以检测加密OPC UA流量中的攻击，但残余结构可观测性与攻击可检测性之间的关系仍未得到充分理解。本文提出了一个解释框架，结合了结构可观测性概况、结构泄漏分数（SLS），并通过族内和跨族比较、阶段特定分析和维度消融分析进行控制。使用 Jensen-Shannon 散度来表征传输、时间和协议生命周期维度，而 SLS 总结了残余结构大小。在工业专用5G测试平台上的评估涵盖了四个攻击族，其标称活动逐渐减少。SLS通常跟踪族内召回趋势，但不能重现跨族可检测性排序。解释这些不匹配还需要时间流行度、突发间持续性、预测效用、独特贡献和冗余性。该框架通过将检测结果与可观测结构证据的大小、时间分布和预测作用联系起来，补充了传统的IDS指标。
英文摘要
OPC Unified Architecture (OPC UA) encryption conceals application-layer semantics and restricts intrusion detection to residual communication structure. Although machine learning-based intrusion detection systems (IDSs) can detect attacks in encrypted OPC UA traffic, the relationship between residual structural observability and attack detectability remains insufficiently understood. This paper presents an explanatory framework combining a structural observability profile, the Structural Leakage Score (SLS), controlled within-family and cross-family comparisons, phase-specific analysis, and dimension-ablation analysis. Jensen--Shannon divergence is used to characterize transport, temporal, and protocol-lifecycle dimensions, while the SLS summarizes the residual structural magnitude. Evaluation on an industrial private 5G testbed covers four attack families with progressively reduced nominal activity. SLS generally tracks within-family recall trends but does not reproduce cross-family detectability ordering. Interpreting these mismatches also requires temporal prevalence, inter-burst persistence, predictive utility, unique contribution, and redundancy. The framework complements conventional IDS metrics by relating detection outcomes to the magnitude, temporal distribution, and predictive role of observable structural evidence.
Comments13 pages, 5 figures. Accepted for presentation at the 52nd Annual Conference of the IEEE Industrial Electronics Society (IECON 2026), Doha, Qatar, October 18--21, 2026
