Security Implications of 5G Communication in Industrial Systems
Pith reviewed 2026-05-10 15:22 UTC · model grok-4.3
The pith
Degraded 5G channels amplify attacks on industrial control systems and break pattern-based detection.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
Under optimal channel conditions, industrial 5G networks can achieve resilience comparable to wired systems, while degraded channel conditions can amplify traditional attacks, threaten system stability, and undermine detection mechanisms based on predictable traffic patterns. The work further demonstrates the inherent limits of securing 5G channels for ICS through eavesdropping and jamming on the open-air interface.
What carries the argument
The SWICS virtual testbed, which places a simulated industrial control system inside a realistic 5G radio environment to measure attack success, system stability, and detection performance across varying channel conditions.
If this is right
- Traditional security controls become insufficient once 5G replaces wired links in ICS.
- Detection methods that rely on steady traffic patterns lose effectiveness when radio conditions vary.
- System stability can be directly threatened by attacks that exploit poor channel conditions.
- Securing the open-air 5G interface alone cannot prevent eavesdropping or jamming against industrial traffic.
Where Pith is reading between the lines
- Operators could add real-time channel-quality monitoring to trigger extra defenses when conditions degrade.
- The same evaluation approach could be applied to other wireless standards such as 6G in critical infrastructure.
- Testbed validation against physical hardware remains necessary before the results guide deployment decisions.
Load-bearing premise
The virtual testbed accurately reproduces real-world 5G channel conditions, attack surfaces, and industrial control system behavior.
What would settle it
Running the same attack scenarios on a physical 5G industrial testbed under controlled degraded channel conditions and comparing attack success rates, stability loss, and detection false-negative rates against the SWICS results.
Figures
read the original abstract
Traditionally, industrial control systems (ICS) were designed without security in mind, prioritizing availability and real-time communication. As these systems increasingly become targets of powerful adversaries, security can no longer be neglected. Driven by flexibility and automation needs, ICS are transitioning from wired to 5G communication, introducing new attack surfaces and a less reliable communication medium, thereby exacerbating existing security challenges. Given their critical role in society, a comprehensive evaluation of their security is imperative. To this end, we introduce SWICS, a fully virtual testbed simulating an ICS in a realistic 5G environment, and study how this transition affects security under varying channel conditions. Our results show three key findings: under optimal channel conditions, industrial 5G networks can achieve resilience comparable to wired systems, while degraded channel conditions can amplify traditional attacks, threaten system stability, and undermine detection mechanisms based on predictable traffic patterns. We further demonstrate the inherent limits of securing 5G channels for ICS through eavesdropping and jamming on the open-air interface. Our work highlights the interplay between security and 5G channel conditions, showing that traditional security controls may no longer be sufficient and motivating further research.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript introduces SWICS, a fully virtual testbed for simulating industrial control systems (ICS) in realistic 5G environments, and uses it to evaluate how the transition from wired to 5G communication affects security under varying channel conditions. The central claims are that optimal 5G channel conditions can yield resilience comparable to wired systems, while degraded conditions amplify traditional attacks, threaten system stability, undermine pattern-based detection mechanisms, and expose inherent limits of open-air 5G security through eavesdropping and jamming.
Significance. If the SWICS simulation faithfully captures real 5G PHY/MAC effects, protocol behavior, and ICS dynamics, the work would be significant for industrial cybersecurity by demonstrating the strong dependence of security properties on channel quality and motivating channel-aware defenses. The introduction of a virtual testbed itself is a constructive contribution that could support further reproducible studies in the area.
major comments (2)
- [Abstract] Abstract: The three key findings on channel-dependent resilience, attack amplification, and detection undermining are presented as simulation outcomes, yet the abstract (and by extension the evaluation) supplies no methodological details on the 5G channel model, error analysis, statistical validation, or comparison baselines against wired systems.
- [SWICS testbed description] SWICS testbed description: All reported security deltas rest on the unverified assumption that the virtual testbed accurately reproduces real-world 5G channel conditions (fading, interference, open-air eavesdropping/jamming), protocol stack, and control-loop dynamics; no calibration data, hardware cross-checks, or comparison to physical 5G traces or deployed ICS are described, which is load-bearing for the transferability of the claims.
minor comments (1)
- The abstract is information-dense; consider separating the three key findings into a bulleted list for improved readability.
Simulated Author's Rebuttal
We thank the referee for the constructive and detailed feedback on our manuscript. We have reviewed the major comments carefully and provide point-by-point responses below, indicating planned revisions to strengthen the presentation of the SWICS testbed and its results.
read point-by-point responses
-
Referee: [Abstract] Abstract: The three key findings on channel-dependent resilience, attack amplification, and detection undermining are presented as simulation outcomes, yet the abstract (and by extension the evaluation) supplies no methodological details on the 5G channel model, error analysis, statistical validation, or comparison baselines against wired systems.
Authors: We agree that the abstract, while concise, would benefit from a brief indication of the methodological foundation to better contextualize the findings. In the revised manuscript we will update the abstract to reference the use of standardized 3GPP 5G channel models (incorporating fading and interference), the statistical validation performed across repeated simulation runs with error analysis, and the explicit wired-system baselines employed for comparison. These elements are described in detail in the methods and evaluation sections; the abstract revision will improve immediate accessibility without altering its length substantially. revision: yes
-
Referee: [SWICS testbed description] SWICS testbed description: All reported security deltas rest on the unverified assumption that the virtual testbed accurately reproduces real-world 5G channel conditions (fading, interference, open-air eavesdropping/jamming), protocol stack, and control-loop dynamics; no calibration data, hardware cross-checks, or comparison to physical 5G traces or deployed ICS are described, which is load-bearing for the transferability of the claims.
Authors: We acknowledge the referee's point on the importance of testbed fidelity for claim transferability. The SWICS testbed is constructed from established, publicly documented simulation components for the 5G PHY/MAC layers and ICS dynamics. In the revised version we will expand the testbed description section to include explicit parameter values for the channel models (fading, interference, and open-air effects), the protocol stack emulation details, control-loop timing models, and the statistical validation procedures (including run counts, confidence intervals, and error analysis). We will also add a dedicated limitations subsection discussing model assumptions and citing prior validation studies of the underlying simulators against real 5G traces. As the work is a fully virtual study, hardware cross-checks with physical deployments were outside its scope; however, the added details and citations will better substantiate the simulation's grounding in accepted models. revision: partial
Circularity Check
No significant circularity: empirical simulation study with independent testbed results
full rationale
The paper introduces the SWICS virtual testbed and reports simulation outcomes on 5G ICS security under optimal versus degraded channel conditions. No equations, derivations, parameter fittings, or predictions appear in the abstract or described content. The central findings are presented as direct outputs of the simulation runs rather than reductions to prior inputs or self-citations. The testbed fidelity is an external modeling assumption, not a self-referential loop, and the work contains no load-bearing self-citations or ansatz smuggling. This is a standard empirical simulation paper whose claims stand or fall on the (unverified) accuracy of the simulator, not on any internal definitional circularity.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption The virtual testbed SWICS faithfully reproduces real 5G channel conditions and industrial control system dynamics
invented entities (1)
-
SWICS testbed
no independent evidence
Reference graph
Works this paper leans on
-
[1]
3rd Generation Partnership Project (3GPP). 2023.TS 38.521-2 V16.4.0; User Equip- ment (UE) conformance specification; Radio transmission and reception; Part 2: Range 2 standalone. Technical Report
work page 2023
-
[2]
2024.TR 38.901 V18.0.0; Study on channel model for frequencies from 0.5 to 100 GHz
3rd Generation Partnership Project (3GPP). 2024.TR 38.901 V18.0.0; Study on channel model for frequencies from 0.5 to 100 GHz. Technical Report
work page 2024
-
[3]
2024.TS 38.104 V18.9.0; Base Station (BS) radio transmission and reception
3rd Generation Partnership Project (3GPP). 2024.TS 38.104 V18.9.0; Base Station (BS) radio transmission and reception. Technical Report
work page 2024
-
[4]
5G-ACIA. 2019. 5G for Automation in Industry. https://5g-acia .org/wp-content/ uploads/2021/04/5G-ACIA_5G-for-Automation-in-Industry-.pdf
work page 2019
-
[5]
2021.Security Aspects of 5G for Industrial Networks
5G-ACIA. 2021.Security Aspects of 5G for Industrial Networks. Technical Re- port. https://5g-acia .org/whitepapers/security-aspects-of-5g-for-industrial- networks/ Last accessed: June 18, 2024
work page 2021
-
[6]
5G-ACIA. 2025. Industrial 5G Edge Computing - Use Cases, Architecture and Deployment. https://5g-acia .org/whitepapers/industrial-5g-edge-computing- use-cases-architecture-and-deployment/. Accessed: 2025-05-21
work page 2025
-
[7]
Syed Ghazanfar Abbas et al. 2024. SAIN: Improving ICS Attack Detection Sensi- tivity via State-Aware Invariants. InUSENIX ’24
work page 2024
-
[8]
Esmail M M Abuhdima et al. 2021. Impact of Weather Conditions on 5G Commu- nication Channel under Connected Vehicles Framework
work page 2021
-
[9]
Sridhar Adepu et al. 2017. WaterJam: An Experimental Case Study of Jamming Attacks on a Water Treatment System. InQRS-C ’17
work page 2017
-
[10]
Chuadhry M. Ahmed et al . 2020. Challenges in Machine Learning based ap- proaches for Real-Time Anomaly Detection in Industrial Control Systems. In CPSS ’20
work page 2020
-
[11]
Adnan Aijaz. 2020. Private 5G: The Future of Industrial Wireless.IEEE Industrial Electronics Magazine14
work page 2020
-
[12]
Wael Alsabbagh et al. 2024. A Payload of Lies: False Data Injection Attacks on MQTT-based IIoT Systems. InIECON ’24
work page 2024
-
[13]
Daniele Antonioli et al. 2017. Gamifying ICS Security Training and Research: Design, Implementation, and Results of S3. InCPS ’17
work page 2017
-
[14]
Wissam Aoudi et al. 2018. Truth Will Out: Departure-Based Process-Level Detec- tion of Stealthy Attacks on Control Systems. InCCS ’18
work page 2018
-
[15]
Youness Arjoune and Saleh Faruque. 2020. Smart Jamming Attacks in 5G New Radio: A Review. InCCWC ’20
work page 2020
-
[16]
Michael J Assante and Robert M Lee. 2015. The Industrial Control System Cyber Kill Chain.SANS Institute InfoSec Reading Room
work page 2015
-
[17]
Sulabh Bhattarai et al. 2015. On Simulation Studies of Jamming Threats against LTE Networks. InICNC ’15
work page 2015
-
[18]
Agnius Birutis and Anders Mykkeltveit. 2022. Practical Jamming of a Commercial 5G Radio System at 3.6 GHz.ICMCIS205
work page 2022
-
[19]
2022.A Study of 5G New Radio and Its Vulnerability to Jamming
Agnius Birutis et al . 2022.A Study of 5G New Radio and Its Vulnerability to Jamming. Technical Report. Norwegian Defense Research Establishment
work page 2022
-
[20]
Marco Caselli et al. 2015. Modeling message sequences for intrusion detection in industrial control systems. InICCIP ’15
work page 2015
-
[21]
Merlin Chlosta et al. 2021. 5G SUCI-catchers: still catching them all?. InWiSec ’21
work page 2021
-
[22]
Mauro Conti et al. 2021. A Survey on Industrial Control System Testbeds and Datasets for Security Research.IEEE Communications Surveys & Tutorials23, 4
work page 2021
-
[23]
Markus Dahlmanns et al. 2022. Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things. InASIA CCS ’22
work page 2022
-
[24]
Khalil G Queiroz de Santana et al . 2024. Cybersecurity Testbeds for IoT: A Systematic Literature Review and Taxonomy.Journal of Internet Services and Applications15
work page 2024
-
[25]
Alireza Dehlaghi-Ghadim et al . 2023. ICSSIM — A Framework for Building Industrial Control Systems Security Testbeds.Computers in Industry148
work page 2023
-
[26]
Erik Dekker and Patrick Spaans. 2020. Performance comparison of VPN imple- mentations WireGuard, strongSwan, and OpenVPN in a 1 Gbit/s environment
work page 2020
-
[27]
Marietheres Dietz et al. 2020. Integrating Digital Twin Security Simulations in the Security Operations Center. InARES ’20
work page 2020
-
[28]
Constantine Doumanidis et al . 2023. ICSML: Industrial Control Systems ML Framework for native inference using IEC 61131-3 code. InCPSS ’23
work page 2023
-
[29]
2019.INDUSTRY 4.0 CYBERSECURITY:CHALLENGES & RECOMMENDA- TIONS
ENISA. 2019.INDUSTRY 4.0 CYBERSECURITY:CHALLENGES & RECOMMENDA- TIONS. Technical Report
work page 2019
-
[30]
Benedikt Ferling et al. 2018. Intrusion detection for sequence-based attacks with reduced traffic models. InMMB ’18
work page 2018
-
[31]
Joseph Gardiner et al. 2019. Oops I Did it Again: Further Adventures in the Land of ICS Security Testbeds. InCPS-SPC ’19
work page 2019
-
[32]
GSMA. 2022. 5G mmWave Deployment Best Practices: Design White Paper. https://www.gsma.com/solutions-and-impact/technologies/networks/wp- content/uploads/2022/10/FINAL-5G-mmWave-Deployment-Best-Practices- Design-White-Paper-November-2022.pdf
work page 2022
-
[33]
Karsten Heimann et al . 2020. Reflecting Surfaces for Beyond Line-Of-Sight Coverage in Millimeter Wave Vehicular Networks. In2020 IEEE VNC
work page 2020
-
[34]
Kevin E. Hemsley and Dr. Ronald E. Fisher. 2018.History of Industrial Control System Cyber Incidents. Technical Report. Idaho National Laboratory, USA
work page 2018
-
[35]
Martin Henze et al . 2017. Network Security and Privacy for Cyber-Physical Systems.Sec. and Priv. in CPS: Foundations, Principles and Applications
work page 2017
-
[36]
Syed Rafiul Hussain et al. 2019. Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information. InNDSS ’19
work page 2019
-
[37]
Vyron Kampourakis et al. 2023. A Systematic Literature Review on Wireless Security Testbeds in the Cyber-Physical Realm.Computers & Security133
work page 2023
-
[38]
Eric D. Knapp. 2024. Industrial Cybersecurity History and Trends. InIndustrial Network Security
work page 2024
-
[39]
Andrea Lacava et al. 2024. Programmable and Customized Intelligence for Traffic Steering in 5G Networks Using Open RAN Architectures.ITMC ’2423
work page 2024
-
[40]
Gyeoul Lee et al. 2021. Network Flow Data Re-collecting Approach Using 5G Testbed for Labeled Dataset. InICACT ’23
work page 2021
-
[41]
Stefan Lenz et al. 2026. SWICS. https://github.com/RWTH-SPICe/SWICS
work page 2026
-
[42]
Chih-Yuan Lin et al. 2018. Timing-Based Anomaly Detection in SCADA Networks. InCRITIS ’21
work page 2018
-
[43]
Norbert Ludant and Guevara Noubir. 2021. SigUnder: a stealthy 5G low power attack and defenses. InWiSec ’21
work page 2021
-
[44]
Norbert Ludant et al . 2025. Low-Layer Attacks Against 4G/5G Networks. In WiSec ’25
work page 2025
-
[45]
Arman Maghsoudnia et al . 2024. Ultra-Reliable Low-Latency in 5G: A Close Reality or a Distant Goal?. InHotNets ’24
work page 2024
-
[46]
Marco Mezzavilla et al. 2018. End-to-End Simulation of 5G mmWave Networks. IEEE Communications Surveys & Tutorials20
work page 2018
-
[47]
Sotiris Michaelides et al. 2026. Evaluation of Security-Induced Latency on 5G RAN Interfaces and User Plane Communication. InProceedings of the 19th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec)
work page 2026
-
[48]
Sotiris Michaelides et al. 2025. Secure Integration of 5G in Industrial Networks: State of the Art, Challenges and Opportunities.Fut. Gen. Com. Sys.166
work page 2025
-
[49]
Sotiris Michaelides et al. 2025. Assessing the Latency of Network Layer Security in 5G Networks. InWiSec ’25
work page 2025
-
[50]
Abubakar S. Mohammed et al. 2023. Detection and Mitigation of Field Flooding Attacks on Oil and Gas Critical Infrastructure Communication.Com. & Sec.124
work page 2023
-
[51]
Andrei Munteanu et al. 2020. Impact Analysis of Cyber-Physical Attacks on a Water Tank System via Statistical Model Checking. InFormaliSE ’20
work page 2020
-
[52]
Ian Oliver et al. 2018. A Testbed for Trusted Telecommunications Systems in a Safety Critical Environment. InSAFECOMP ’18
work page 2018
-
[53]
Natale Patriciello et al. 2019. An E2E simulator for 5G NR networks.Simulation Modelling Practice and Theory96
work page 2019
-
[54]
Hitesh Poddar et al. 2023. ns-3 Implementation of Sub-Terahertz and Millimeter Wave Drop-based NYU Channel Model (NYUSIM). InWNS3 ’23
work page 2023
-
[55]
Jay Prakash and Chuadhry Mujeeb Ahmed. 2017. Can You See Me: On Perfor- mance of Wireless Fingerprinting in a Cyber Physical System. InHASE ’17
work page 2017
-
[56]
Darijo Raca et al. 2020. Beyond Throughput, The Next Generation: A 5G Dataset with Channel and Context Metrics. InMMSys ’20
work page 2020
-
[57]
Nicholas R. Rodofile et al. 2017. Process Control Cyber-Attacks and Labelled Datasets on S7Comm Critical Infrastructure. InInformation Security and Privacy
work page 2017
-
[58]
David Rupprecht et al. 2019. Breaking LTE on Layer Two. InS&P ’19
work page 2019
-
[59]
Mahmoud Salem et al. 2016. Anomaly Detection Using Inter-Arrival Curves for Real-Time Systems. InECRTS ’16
work page 2016
-
[60]
Shreya Savadatti et al. 2024. An Extensive Classification of 5G Network Jamming Attacks.Sec. and Commun. Netw
work page 2024
-
[61]
Amina Seferagić et al. 2020. Survey on Wireless Technology Trade-Offs for the Industrial Internet of Things.Sensors20
work page 2020
-
[62]
Paweł Skokowski et al. 2022. Jamming and jamming mitigation for selected 5G military scenarios.ICMCIS ’22205
work page 2022
-
[63]
tec-science. 2019. Discharge of Liquids (Torricelli’s law). online. https://www.tec-science.com/mechanics/gases-and-liquids/discharge- outflow-liquid-speed-torricellis-law/, last accessed: 2024-10-21
work page 2019
-
[64]
Ivana Tomić et al. 2018. Design and Evaluation of Jamming Resilient Cyber- Physical Systems. InSmartData ’18
work page 2018
-
[65]
Pavan G V et al. 2022. Survey on Security Risks in 5G Private Industrial Networks. InI4C ’22
work page 2022
-
[66]
Zibo Wang et al. 2023. A Survey on Programmable Logic Controller Vulnerabili- ties, Attacks, Detections, and Forensics.Processes11, 3
work page 2023
-
[67]
Konrad Wolsing et al. 2023. One IDS is not enough! Exploring Ensemble Learning for Industrial Intrusion Detection. InESORICS ’23
work page 2023
-
[68]
Konrad Wolsing et al. 2022. Can Industrial Intrusion Detection Be SIMPLE?. In ESORICS ’22
work page 2022
-
[69]
Konrad Wolsing et al . 2024. Deployment Challenges of Industrial Intrusion Detection Systems. InESORICS ’24
work page 2024
-
[70]
Konrad Wolsing et al. 2022. IPAL: Breaking up Silos of Protocol-dependent and Domain-specific Industrial Intrusion Detection Systems. InRAID ’22
work page 2022
-
[71]
Jiarong Xing et al. 2024. On the Criticality of Integrity Protection in 5G Fronthaul Networks. InUSENIX ’24
work page 2024
-
[72]
Hojoon Yang et al. 2019. Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. InUSENIX ’19
work page 2019
-
[73]
Rozhin Yasaei et al. 2020. IoT-CAD: context-aware adaptive anomaly detection in IoT systems through sensor association. InICCAD ’20
work page 2020
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.