pith. sign in

arxiv: 2604.11509 · v1 · submitted 2026-04-13 · 💻 cs.CR · cs.NI· cs.SY· eess.SY

Security Implications of 5G Communication in Industrial Systems

Pith reviewed 2026-05-10 15:22 UTC · model grok-4.3

classification 💻 cs.CR cs.NIcs.SYeess.SY
keywords 5G securityindustrial control systemsvirtual testbedchannel conditionsattack amplificationICS resilienceopen-air interface
0
0 comments X

The pith

Degraded 5G channels amplify attacks on industrial control systems and break pattern-based detection.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper evaluates how replacing wired links with 5G in industrial control systems changes their exposure to attacks. It builds SWICS, a virtual testbed that places a realistic ICS inside a simulated 5G radio environment, then measures security and stability under both ideal and impaired channel conditions. The central result is that good radio conditions let 5G match the resilience of wired systems, yet poor conditions make known attacks more effective, destabilize the plant, and invalidate detectors that assume steady traffic patterns. The authors also show that the open-air 5G interface itself cannot be fully protected against eavesdropping or jamming. Because many factories are adopting 5G for flexibility, these channel-dependent weaknesses affect the security of critical infrastructure.

Core claim

Under optimal channel conditions, industrial 5G networks can achieve resilience comparable to wired systems, while degraded channel conditions can amplify traditional attacks, threaten system stability, and undermine detection mechanisms based on predictable traffic patterns. The work further demonstrates the inherent limits of securing 5G channels for ICS through eavesdropping and jamming on the open-air interface.

What carries the argument

The SWICS virtual testbed, which places a simulated industrial control system inside a realistic 5G radio environment to measure attack success, system stability, and detection performance across varying channel conditions.

If this is right

  • Traditional security controls become insufficient once 5G replaces wired links in ICS.
  • Detection methods that rely on steady traffic patterns lose effectiveness when radio conditions vary.
  • System stability can be directly threatened by attacks that exploit poor channel conditions.
  • Securing the open-air 5G interface alone cannot prevent eavesdropping or jamming against industrial traffic.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Operators could add real-time channel-quality monitoring to trigger extra defenses when conditions degrade.
  • The same evaluation approach could be applied to other wireless standards such as 6G in critical infrastructure.
  • Testbed validation against physical hardware remains necessary before the results guide deployment decisions.

Load-bearing premise

The virtual testbed accurately reproduces real-world 5G channel conditions, attack surfaces, and industrial control system behavior.

What would settle it

Running the same attack scenarios on a physical 5G industrial testbed under controlled degraded channel conditions and comparing attack success rates, stability loss, and detection false-negative rates against the SWICS results.

Figures

Figures reproduced from arXiv: 2604.11509 by Jonas Holtwick, Martin Henze, Moritz Rickert, Sotiris Michaelides, Stefan Lenz.

Figure 2
Figure 2. Figure 2: SWICS’s behavior (b) closely matches the original [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: We assume that the attacker can modify ICS traffic [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: The conveyor belt speed in the Wired, 5G-GC, and 5G-DC deployments is stable under benign conditions. Under attack, Wired and 5G-GC show similar resilience with only minor jitter-induced deviations, whereas the noisy 5G-DC deployment significantly amplifies the effects of DoS and MiTM attacks due to increased jitter, packet loss, and latency [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: The distributions of inter-arrival times in the [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: The alert behavior of communication-based detectors deployed in the [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: By passively monitoring the 5G channel even from [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
read the original abstract

Traditionally, industrial control systems (ICS) were designed without security in mind, prioritizing availability and real-time communication. As these systems increasingly become targets of powerful adversaries, security can no longer be neglected. Driven by flexibility and automation needs, ICS are transitioning from wired to 5G communication, introducing new attack surfaces and a less reliable communication medium, thereby exacerbating existing security challenges. Given their critical role in society, a comprehensive evaluation of their security is imperative. To this end, we introduce SWICS, a fully virtual testbed simulating an ICS in a realistic 5G environment, and study how this transition affects security under varying channel conditions. Our results show three key findings: under optimal channel conditions, industrial 5G networks can achieve resilience comparable to wired systems, while degraded channel conditions can amplify traditional attacks, threaten system stability, and undermine detection mechanisms based on predictable traffic patterns. We further demonstrate the inherent limits of securing 5G channels for ICS through eavesdropping and jamming on the open-air interface. Our work highlights the interplay between security and 5G channel conditions, showing that traditional security controls may no longer be sufficient and motivating further research.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The manuscript introduces SWICS, a fully virtual testbed for simulating industrial control systems (ICS) in realistic 5G environments, and uses it to evaluate how the transition from wired to 5G communication affects security under varying channel conditions. The central claims are that optimal 5G channel conditions can yield resilience comparable to wired systems, while degraded conditions amplify traditional attacks, threaten system stability, undermine pattern-based detection mechanisms, and expose inherent limits of open-air 5G security through eavesdropping and jamming.

Significance. If the SWICS simulation faithfully captures real 5G PHY/MAC effects, protocol behavior, and ICS dynamics, the work would be significant for industrial cybersecurity by demonstrating the strong dependence of security properties on channel quality and motivating channel-aware defenses. The introduction of a virtual testbed itself is a constructive contribution that could support further reproducible studies in the area.

major comments (2)
  1. [Abstract] Abstract: The three key findings on channel-dependent resilience, attack amplification, and detection undermining are presented as simulation outcomes, yet the abstract (and by extension the evaluation) supplies no methodological details on the 5G channel model, error analysis, statistical validation, or comparison baselines against wired systems.
  2. [SWICS testbed description] SWICS testbed description: All reported security deltas rest on the unverified assumption that the virtual testbed accurately reproduces real-world 5G channel conditions (fading, interference, open-air eavesdropping/jamming), protocol stack, and control-loop dynamics; no calibration data, hardware cross-checks, or comparison to physical 5G traces or deployed ICS are described, which is load-bearing for the transferability of the claims.
minor comments (1)
  1. The abstract is information-dense; consider separating the three key findings into a bulleted list for improved readability.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive and detailed feedback on our manuscript. We have reviewed the major comments carefully and provide point-by-point responses below, indicating planned revisions to strengthen the presentation of the SWICS testbed and its results.

read point-by-point responses
  1. Referee: [Abstract] Abstract: The three key findings on channel-dependent resilience, attack amplification, and detection undermining are presented as simulation outcomes, yet the abstract (and by extension the evaluation) supplies no methodological details on the 5G channel model, error analysis, statistical validation, or comparison baselines against wired systems.

    Authors: We agree that the abstract, while concise, would benefit from a brief indication of the methodological foundation to better contextualize the findings. In the revised manuscript we will update the abstract to reference the use of standardized 3GPP 5G channel models (incorporating fading and interference), the statistical validation performed across repeated simulation runs with error analysis, and the explicit wired-system baselines employed for comparison. These elements are described in detail in the methods and evaluation sections; the abstract revision will improve immediate accessibility without altering its length substantially. revision: yes

  2. Referee: [SWICS testbed description] SWICS testbed description: All reported security deltas rest on the unverified assumption that the virtual testbed accurately reproduces real-world 5G channel conditions (fading, interference, open-air eavesdropping/jamming), protocol stack, and control-loop dynamics; no calibration data, hardware cross-checks, or comparison to physical 5G traces or deployed ICS are described, which is load-bearing for the transferability of the claims.

    Authors: We acknowledge the referee's point on the importance of testbed fidelity for claim transferability. The SWICS testbed is constructed from established, publicly documented simulation components for the 5G PHY/MAC layers and ICS dynamics. In the revised version we will expand the testbed description section to include explicit parameter values for the channel models (fading, interference, and open-air effects), the protocol stack emulation details, control-loop timing models, and the statistical validation procedures (including run counts, confidence intervals, and error analysis). We will also add a dedicated limitations subsection discussing model assumptions and citing prior validation studies of the underlying simulators against real 5G traces. As the work is a fully virtual study, hardware cross-checks with physical deployments were outside its scope; however, the added details and citations will better substantiate the simulation's grounding in accepted models. revision: partial

Circularity Check

0 steps flagged

No significant circularity: empirical simulation study with independent testbed results

full rationale

The paper introduces the SWICS virtual testbed and reports simulation outcomes on 5G ICS security under optimal versus degraded channel conditions. No equations, derivations, parameter fittings, or predictions appear in the abstract or described content. The central findings are presented as direct outputs of the simulation runs rather than reductions to prior inputs or self-citations. The testbed fidelity is an external modeling assumption, not a self-referential loop, and the work contains no load-bearing self-citations or ansatz smuggling. This is a standard empirical simulation paper whose claims stand or fall on the (unverified) accuracy of the simulator, not on any internal definitional circularity.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim depends on the simulation being a faithful model of real 5G ICS environments and on the chosen attack scenarios being representative.

axioms (1)
  • domain assumption The virtual testbed SWICS faithfully reproduces real 5G channel conditions and industrial control system dynamics
    All reported results rest on this unverified modeling assumption stated in the abstract.
invented entities (1)
  • SWICS testbed no independent evidence
    purpose: Simulate an ICS in a realistic 5G environment to study security under varying channel conditions
    Newly introduced simulation platform whose realism is not independently validated in the abstract.

pith-pipeline@v0.9.0 · 5519 in / 1213 out tokens · 48572 ms · 2026-05-10T15:22:56.972397+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

73 extracted references · 73 canonical work pages

  1. [1]

    2023.TS 38.521-2 V16.4.0; User Equip- ment (UE) conformance specification; Radio transmission and reception; Part 2: Range 2 standalone

    3rd Generation Partnership Project (3GPP). 2023.TS 38.521-2 V16.4.0; User Equip- ment (UE) conformance specification; Radio transmission and reception; Part 2: Range 2 standalone. Technical Report

  2. [2]

    2024.TR 38.901 V18.0.0; Study on channel model for frequencies from 0.5 to 100 GHz

    3rd Generation Partnership Project (3GPP). 2024.TR 38.901 V18.0.0; Study on channel model for frequencies from 0.5 to 100 GHz. Technical Report

  3. [3]

    2024.TS 38.104 V18.9.0; Base Station (BS) radio transmission and reception

    3rd Generation Partnership Project (3GPP). 2024.TS 38.104 V18.9.0; Base Station (BS) radio transmission and reception. Technical Report

  4. [4]

    5G-ACIA. 2019. 5G for Automation in Industry. https://5g-acia .org/wp-content/ uploads/2021/04/5G-ACIA_5G-for-Automation-in-Industry-.pdf

  5. [5]

    2021.Security Aspects of 5G for Industrial Networks

    5G-ACIA. 2021.Security Aspects of 5G for Industrial Networks. Technical Re- port. https://5g-acia .org/whitepapers/security-aspects-of-5g-for-industrial- networks/ Last accessed: June 18, 2024

  6. [6]

    5G-ACIA. 2025. Industrial 5G Edge Computing - Use Cases, Architecture and Deployment. https://5g-acia .org/whitepapers/industrial-5g-edge-computing- use-cases-architecture-and-deployment/. Accessed: 2025-05-21

  7. [7]

    Syed Ghazanfar Abbas et al. 2024. SAIN: Improving ICS Attack Detection Sensi- tivity via State-Aware Invariants. InUSENIX ’24

  8. [8]

    Esmail M M Abuhdima et al. 2021. Impact of Weather Conditions on 5G Commu- nication Channel under Connected Vehicles Framework

  9. [9]

    Sridhar Adepu et al. 2017. WaterJam: An Experimental Case Study of Jamming Attacks on a Water Treatment System. InQRS-C ’17

  10. [10]

    Ahmed et al

    Chuadhry M. Ahmed et al . 2020. Challenges in Machine Learning based ap- proaches for Real-Time Anomaly Detection in Industrial Control Systems. In CPSS ’20

  11. [11]

    Adnan Aijaz. 2020. Private 5G: The Future of Industrial Wireless.IEEE Industrial Electronics Magazine14

  12. [12]

    Wael Alsabbagh et al. 2024. A Payload of Lies: False Data Injection Attacks on MQTT-based IIoT Systems. InIECON ’24

  13. [13]

    Daniele Antonioli et al. 2017. Gamifying ICS Security Training and Research: Design, Implementation, and Results of S3. InCPS ’17

  14. [14]

    Wissam Aoudi et al. 2018. Truth Will Out: Departure-Based Process-Level Detec- tion of Stealthy Attacks on Control Systems. InCCS ’18

  15. [15]

    Youness Arjoune and Saleh Faruque. 2020. Smart Jamming Attacks in 5G New Radio: A Review. InCCWC ’20

  16. [16]

    Michael J Assante and Robert M Lee. 2015. The Industrial Control System Cyber Kill Chain.SANS Institute InfoSec Reading Room

  17. [17]

    Sulabh Bhattarai et al. 2015. On Simulation Studies of Jamming Threats against LTE Networks. InICNC ’15

  18. [18]

    Agnius Birutis and Anders Mykkeltveit. 2022. Practical Jamming of a Commercial 5G Radio System at 3.6 GHz.ICMCIS205

  19. [19]

    2022.A Study of 5G New Radio and Its Vulnerability to Jamming

    Agnius Birutis et al . 2022.A Study of 5G New Radio and Its Vulnerability to Jamming. Technical Report. Norwegian Defense Research Establishment

  20. [20]

    Marco Caselli et al. 2015. Modeling message sequences for intrusion detection in industrial control systems. InICCIP ’15

  21. [21]

    Merlin Chlosta et al. 2021. 5G SUCI-catchers: still catching them all?. InWiSec ’21

  22. [22]

    Mauro Conti et al. 2021. A Survey on Industrial Control System Testbeds and Datasets for Security Research.IEEE Communications Surveys & Tutorials23, 4

  23. [23]

    Markus Dahlmanns et al. 2022. Missed Opportunities: Measuring the Untapped TLS Support in the Industrial Internet of Things. InASIA CCS ’22

  24. [24]

    Khalil G Queiroz de Santana et al . 2024. Cybersecurity Testbeds for IoT: A Systematic Literature Review and Taxonomy.Journal of Internet Services and Applications15

  25. [25]

    Alireza Dehlaghi-Ghadim et al . 2023. ICSSIM — A Framework for Building Industrial Control Systems Security Testbeds.Computers in Industry148

  26. [26]

    Erik Dekker and Patrick Spaans. 2020. Performance comparison of VPN imple- mentations WireGuard, strongSwan, and OpenVPN in a 1 Gbit/s environment

  27. [27]

    Marietheres Dietz et al. 2020. Integrating Digital Twin Security Simulations in the Security Operations Center. InARES ’20

  28. [28]

    Constantine Doumanidis et al . 2023. ICSML: Industrial Control Systems ML Framework for native inference using IEC 61131-3 code. InCPSS ’23

  29. [29]

    2019.INDUSTRY 4.0 CYBERSECURITY:CHALLENGES & RECOMMENDA- TIONS

    ENISA. 2019.INDUSTRY 4.0 CYBERSECURITY:CHALLENGES & RECOMMENDA- TIONS. Technical Report

  30. [30]

    Benedikt Ferling et al. 2018. Intrusion detection for sequence-based attacks with reduced traffic models. InMMB ’18

  31. [31]

    Joseph Gardiner et al. 2019. Oops I Did it Again: Further Adventures in the Land of ICS Security Testbeds. InCPS-SPC ’19

  32. [32]

    GSMA. 2022. 5G mmWave Deployment Best Practices: Design White Paper. https://www.gsma.com/solutions-and-impact/technologies/networks/wp- content/uploads/2022/10/FINAL-5G-mmWave-Deployment-Best-Practices- Design-White-Paper-November-2022.pdf

  33. [33]

    Karsten Heimann et al . 2020. Reflecting Surfaces for Beyond Line-Of-Sight Coverage in Millimeter Wave Vehicular Networks. In2020 IEEE VNC

  34. [34]

    Hemsley and Dr

    Kevin E. Hemsley and Dr. Ronald E. Fisher. 2018.History of Industrial Control System Cyber Incidents. Technical Report. Idaho National Laboratory, USA

  35. [35]

    Martin Henze et al . 2017. Network Security and Privacy for Cyber-Physical Systems.Sec. and Priv. in CPS: Foundations, Principles and Applications

  36. [36]

    Syed Rafiul Hussain et al. 2019. Privacy Attacks to the 4G and 5G Cellular Paging Protocols Using Side Channel Information. InNDSS ’19

  37. [37]

    Vyron Kampourakis et al. 2023. A Systematic Literature Review on Wireless Security Testbeds in the Cyber-Physical Realm.Computers & Security133

  38. [38]

    Eric D. Knapp. 2024. Industrial Cybersecurity History and Trends. InIndustrial Network Security

  39. [39]

    Andrea Lacava et al. 2024. Programmable and Customized Intelligence for Traffic Steering in 5G Networks Using Open RAN Architectures.ITMC ’2423

  40. [40]

    Gyeoul Lee et al. 2021. Network Flow Data Re-collecting Approach Using 5G Testbed for Labeled Dataset. InICACT ’23

  41. [41]

    Stefan Lenz et al. 2026. SWICS. https://github.com/RWTH-SPICe/SWICS

  42. [42]

    Chih-Yuan Lin et al. 2018. Timing-Based Anomaly Detection in SCADA Networks. InCRITIS ’21

  43. [43]

    Norbert Ludant and Guevara Noubir. 2021. SigUnder: a stealthy 5G low power attack and defenses. InWiSec ’21

  44. [44]

    Norbert Ludant et al . 2025. Low-Layer Attacks Against 4G/5G Networks. In WiSec ’25

  45. [45]

    Arman Maghsoudnia et al . 2024. Ultra-Reliable Low-Latency in 5G: A Close Reality or a Distant Goal?. InHotNets ’24

  46. [46]

    Marco Mezzavilla et al. 2018. End-to-End Simulation of 5G mmWave Networks. IEEE Communications Surveys & Tutorials20

  47. [47]

    Sotiris Michaelides et al. 2026. Evaluation of Security-Induced Latency on 5G RAN Interfaces and User Plane Communication. InProceedings of the 19th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec)

  48. [48]

    Sotiris Michaelides et al. 2025. Secure Integration of 5G in Industrial Networks: State of the Art, Challenges and Opportunities.Fut. Gen. Com. Sys.166

  49. [49]

    Sotiris Michaelides et al. 2025. Assessing the Latency of Network Layer Security in 5G Networks. InWiSec ’25

  50. [50]

    Mohammed et al

    Abubakar S. Mohammed et al. 2023. Detection and Mitigation of Field Flooding Attacks on Oil and Gas Critical Infrastructure Communication.Com. & Sec.124

  51. [51]

    Andrei Munteanu et al. 2020. Impact Analysis of Cyber-Physical Attacks on a Water Tank System via Statistical Model Checking. InFormaliSE ’20

  52. [52]

    Ian Oliver et al. 2018. A Testbed for Trusted Telecommunications Systems in a Safety Critical Environment. InSAFECOMP ’18

  53. [53]

    Natale Patriciello et al. 2019. An E2E simulator for 5G NR networks.Simulation Modelling Practice and Theory96

  54. [54]

    Hitesh Poddar et al. 2023. ns-3 Implementation of Sub-Terahertz and Millimeter Wave Drop-based NYU Channel Model (NYUSIM). InWNS3 ’23

  55. [55]

    Jay Prakash and Chuadhry Mujeeb Ahmed. 2017. Can You See Me: On Perfor- mance of Wireless Fingerprinting in a Cyber Physical System. InHASE ’17

  56. [56]

    Darijo Raca et al. 2020. Beyond Throughput, The Next Generation: A 5G Dataset with Channel and Context Metrics. InMMSys ’20

  57. [57]

    Rodofile et al

    Nicholas R. Rodofile et al. 2017. Process Control Cyber-Attacks and Labelled Datasets on S7Comm Critical Infrastructure. InInformation Security and Privacy

  58. [58]

    David Rupprecht et al. 2019. Breaking LTE on Layer Two. InS&P ’19

  59. [59]

    Mahmoud Salem et al. 2016. Anomaly Detection Using Inter-Arrival Curves for Real-Time Systems. InECRTS ’16

  60. [60]

    Shreya Savadatti et al. 2024. An Extensive Classification of 5G Network Jamming Attacks.Sec. and Commun. Netw

  61. [61]

    Amina Seferagić et al. 2020. Survey on Wireless Technology Trade-Offs for the Industrial Internet of Things.Sensors20

  62. [62]

    Paweł Skokowski et al. 2022. Jamming and jamming mitigation for selected 5G military scenarios.ICMCIS ’22205

  63. [63]

    tec-science. 2019. Discharge of Liquids (Torricelli’s law). online. https://www.tec-science.com/mechanics/gases-and-liquids/discharge- outflow-liquid-speed-torricellis-law/, last accessed: 2024-10-21

  64. [64]

    Ivana Tomić et al. 2018. Design and Evaluation of Jamming Resilient Cyber- Physical Systems. InSmartData ’18

  65. [65]

    Pavan G V et al. 2022. Survey on Security Risks in 5G Private Industrial Networks. InI4C ’22

  66. [66]

    Zibo Wang et al. 2023. A Survey on Programmable Logic Controller Vulnerabili- ties, Attacks, Detections, and Forensics.Processes11, 3

  67. [67]

    Konrad Wolsing et al. 2023. One IDS is not enough! Exploring Ensemble Learning for Industrial Intrusion Detection. InESORICS ’23

  68. [68]

    Konrad Wolsing et al. 2022. Can Industrial Intrusion Detection Be SIMPLE?. In ESORICS ’22

  69. [69]

    Konrad Wolsing et al . 2024. Deployment Challenges of Industrial Intrusion Detection Systems. InESORICS ’24

  70. [70]

    Konrad Wolsing et al. 2022. IPAL: Breaking up Silos of Protocol-dependent and Domain-specific Industrial Intrusion Detection Systems. InRAID ’22

  71. [71]

    Jiarong Xing et al. 2024. On the Criticality of Integrity Protection in 5G Fronthaul Networks. InUSENIX ’24

  72. [72]

    Hojoon Yang et al. 2019. Hiding in Plain Signal: Physical Signal Overshadowing Attack on LTE. InUSENIX ’19

  73. [73]

    Rozhin Yasaei et al. 2020. IoT-CAD: context-aware adaptive anomaly detection in IoT systems through sensor association. InICCAD ’20