Newest papers

Latency-Neutral Passive Cyber Monitoring for Grid-Edge Operational Technology Networks

Damian Byrne, Emad Abukhousa, Jason Reed, Saman Zonouz · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28324 · cited by 0 works (OpenAlex) · open-access PDF

German

Deterministische industrielle Netzwerke präsentieren oft einen operativen Kompromiss zwischen der Aufrechterhaltung der Mikrosekunden-Timing der Primärsteuerungsschleifen und der Erfassung von Sicherheitstelemetrie. Diese Arbeit untersucht die technische Machbarkeit des Operational Technology Supervisor (OTSV), einem dreistufigen passiven Überwachungsrahmen, der entworfen wurde, um diese Sichtbarkeitsaufforderung innerhalb der zeitempfindlichen Grid-Edge-Infrastruktur zu lösen. Durch die Verwendung eines Layer-3-unkonfigurierten passiven Eingriffsmodi auf barmetallischer Hardware über einen physikalischen Switched Port Analyzer (SPAN) Schleif wird der Deep Packet Inspection Engine vom Produktionsnetz isoliert und implementiert eine software-förderte einseit

Machine translation (Meta M2M100); the English original follows.

Abstract

Deterministic industrial networks often present an operational trade-off between maintaining microsecond timing of primary control loops and capturing security telemetry. This work investigates the engineering feasibility of the Operational Technology Supervisor (OTSV), a three-tier passive monitoring framework designed to resolve this visibility challenge within timing-sensitive grid-edge infrastructure. By utilizing a Layer-3-unconfigured passive ingestion mode on bare-metal hardware via a physical switched port analyzer (SPAN) loop, the deep packet inspection engine is isolated from the production network, implementing a software-enforced unidirectional export policy. Performance validation conducted over a continuous audit comprising 32,927 active-monitoring round-trip time (RTT) samples yielded stable latency distributions across a laboratory power-monitoring loop running Modbus TCP and IEC 61850 MMS protocols. The measured latency delta between the unmonitored baseline and the active monitoring state was less than 0.12 milliseconds, supporting the feasibility of continuous high-fidelity security observation alongside stringent grid-edge metering timing bounds without measurably degrading the monitored reporting path.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Latency (audio), Modbus, Real-time computing, Network packet, Computer science, Engineering

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange