Newest papers

Latency-Neutral Passive Cyber Monitoring for Grid-Edge Operational Technology Networks

Damian Byrne, Emad Abukhousa, Jason Reed, Saman Zonouz · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28324 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Las redes industriales deterministas a menudo presentan un equilibrio operativo entre el mantenimiento del timing de microsegundos de los circuitos de control primarios y la captura de la telemetría de seguridad. Este trabajo investiga la viabilidad de ingeniería del Supervisor de Tecnología Operativa (OTSV), un marco de monitoreo pasivo de tres niveles diseñado para resolver este desafío de visibilidad dentro de la infraestructura de grid-edge sensible al timing. Al utilizar un modo de ingestión pasiva no configurado de capa 3 en maquinaria de metal negro a través de un loop de análisis de puertos físicos (SPAN), el motor de inspección de paquetes profundos está aislado de la red de producción, implementando una política de exportación unidireccional reforzada por software. La validación del rendimiento llevada a

Machine translation (Meta M2M100); the English original follows.

Abstract

Deterministic industrial networks often present an operational trade-off between maintaining microsecond timing of primary control loops and capturing security telemetry. This work investigates the engineering feasibility of the Operational Technology Supervisor (OTSV), a three-tier passive monitoring framework designed to resolve this visibility challenge within timing-sensitive grid-edge infrastructure. By utilizing a Layer-3-unconfigured passive ingestion mode on bare-metal hardware via a physical switched port analyzer (SPAN) loop, the deep packet inspection engine is isolated from the production network, implementing a software-enforced unidirectional export policy. Performance validation conducted over a continuous audit comprising 32,927 active-monitoring round-trip time (RTT) samples yielded stable latency distributions across a laboratory power-monitoring loop running Modbus TCP and IEC 61850 MMS protocols. The measured latency delta between the unmonitored baseline and the active monitoring state was less than 0.12 milliseconds, supporting the feasibility of continuous high-fidelity security observation alongside stringent grid-edge metering timing bounds without measurably degrading the monitored reporting path.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Latency (audio), Modbus, Real-time computing, Network packet, Computer science, Engineering

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange