The increasing complexity of modern industrial and manufacturing systems, featuring numerous sensors and mobile components, demands reliable, low-latency communication over wireless networks. WiFi 7 addresses these requirements through enhancements such as Multi-Link Operation (MLO), enabling simultaneous use of multiple frequency bands and offering inherent link diversity. This raises the question of whether MLO can be effectively leveraged for reliability in critical systems. In this paper, we explore the integration of IEEE 802.1CB Frame Replication and Elimination for Reliability (FRER), a core Time-Sensitive Networking (TSN) standard, over MLO to address this question. We present an open-source implementation of FRER over MLO in the OMNeT++ simulator, highlight key challenges in combining these technologies, and evaluate its effectiveness in improving reliability under wireless-specific conditions such as mobility and congestion. Our results demonstrate that FRER can enhance packet delivery ratio and ensure bounded latency, albeit at the expense of reduced channel efficiency due to redundancy.

Mission-critical systems (MCSs) have evolving latency and reliability requirements, even under challenging conditions such as node and link failures and cyberattacks. To fulfill these requirements, emerging networking technologies like the IEEE 802.1 Time-Sensitive Networking standards provide several protocols for deterministic communication on top of off-the-shelf Ethernet equipment. While Ethernet-based networks offer better configurability than legacy fieldbus systems, they still require the design of adequate topologies for MCSs that fulfill various design objectives such as optimal quality of service and increased resilience against challenges. In this paper, we propose MITHRIL, a multi-objective topology synthesis model with reinforcement learning. It leverages deep reinforcement learning to optimize Ethernet-based topologies in terms of resilience and effectiveness, while adhering to realistic MCS constraints. Our evaluation indicates that MITHRIL enhances the failure and attack tolerance of network topologies while reducing the associated costs, compared to well-connected topologies and other heuristics from the literature.

The integration of IEEE 802.1 Time-sensitive Networking (TSN) with wireless technologies promises to support realtime applications over hybrid networks. Although TSN over Ethernet is well established, extending its capabilities to WiFi remains a technical challenge due to hardware and protocol differences. In this work, we integrate a core TSN scheduling mechanism, IEEE 802.1Qbv Time-aware Shaper (TAS), with WiFi interfaces in the Linux kernel. Our approach enables scheduling for mixed-criticality traffic over wired and wireless links using standard Linux tools. We provide our implementation and evaluation scenarios as open source to support further research in TSN-WiFi integration.

Modern mission-critical systems (MCS) are increasingly softwarized and interconnected. As a result, their complexity increased, and so their vulnerability against cyber-attacks. The current adoption of virtualization and service-oriented architectures (SOA) in MCSs provides additional flexibility that can be leveraged to withstand and mitigate attacks, e.g., by moving critical services or data flows. This enables the deployment of strategies for moving target defense (MTD), which allows stripping attackers of their asymmetric advantage from the long reconnaissance of MCSs. However, it is challenging to design MTD strategies, given the diverse threat landscape, resource limitations, and potential degradation in service availability. In this paper, we combine two optimization models to explore feasible service configurations for SOA-based systems and to derive subsequent MTD actions with their time schedule based on an attacker-defender game. Our results indicate that even for challenging and diverse attack scenarios, our models can defend the system by up to 90% of the system operation time with a limited MTD defender budget.

Mission-critical systems (MCSs) have embraced new design paradigms such as service-oriented architecture (SOA) and IEEE 802.1 Time-sensitive Networking (TSN). These approaches tackle the static and closed-loop design and configuration of MCSs to address their strict performance and resilience requirements. While SOA enables the dynamic placement of critical services over virtualized hardware, TSN provides several protocols to establish deterministic communication over standard Ethernet equipment. This paper presents a prototype utilizing SOA and TSN to design flexible and fault-tolerant MCSs. It demonstrates the benefits of dynamic service migration and time-sensitive redundancy protocols to increase the resilience of MCSs against node and link failures, respectively. Moreover, it presents additional advanced functionalities like optimal service distribution and security monitoring for new TSN protocols.

Modern mission-critical embedded systems such as autonomous cars and avionics consist of a multitude of intercon-nected nodes and services with various QoS requirements. Virtu-alization provides further flexibility, configurability, and isolation to such systems by enabling dynamic service placement to off-the-shelf virtualized hardware. Although the service-oriented systems usually rely on a single centralized controller for the service configuration and maintenance as well as establishing their inter-communication, more autonomous and self-driven control schemes are required to cope with their increasing scalability and heterogeneity. Accordingly, bio-inspired algorithms (BIAs) offer distributed self-organization methods by adapting the natural phenomena such as collaborating bee and ant colonies for the requirements of modern networked systems. In this paper, we leverage ant-colony optimization to solve the joint service allocation and routing (JSAR) problem distributedly, where mixed-criticality services should be distributed and communicated under strict QoS requirements on a virtualized, physical network. We also introduce an integer linear program (ILP) to find the optimal solution for JSAR that can be computed by a centralized controller. Our experiments show that our heuristics successfully solve JSAR for even scaling scenarios. Besides, utilizing different redeployment strategies, they can be adapted to obtain near-optimal results in terms of resource efficiency.

Industrial control systems (ICSs) have become more complex due to their increasing connectivity, heterogeneity and, autonomy. As a result, cyber-threats against such systems have been significantly increased as well. Since a compromised industrial system can easily lead to hazardous safety and security consequences, it is crucial to develop security countermeasures to protect coexisting IT systems and industrial physical processes being involved in modern ICSs. Accordingly, in this study, we propose a deep learning-based semantic anomaly detection framework to model the complex behavior of ICSs. In contrast to the related work assuming only simpler security threats targeting individual controllers in an ICS, we address multi-PLC attacks that are harder to detect as requiring to observe the overall system state alongside single-PLC attacks. Using industrial simulation and emulation frameworks, we create a realistic setup representing both the production and networking aspects of industrial systems and conduct some potential attacks. Our experimental results indicate that our model can detect single-PLC attacks with ~95% accuracy and multi-PLC attacks with 80% accuracy and nearly 1% false positive rate.

Future networks will need to support a large number of low-latency flows. In time-sensitive networks (TSN), paths for data flows are usually established at startup time of an application and remain untouched until the flow ends. There is no way to migrate existing flows easily to alternative paths without inducing significant additional delay or wasting resources. Therefore, the resource-utilization of TSN might degrade over time leading to a sub-optimal flow assignment. In this paper we address this problem by combining Software-defined Networking (SDN) that provides better control on network flows with TSN to be able to seamlessly migrate time-sensitive flows. We propose a SDN-based dynamic path reconfiguration algorithm for accommodating TSN flows and formulate it as optimization problem. By exploiting the control plane’s global view, we evaluate different dynamic path configuration strategies under deterministic communication requirements. Our simulation results indicate that reconfiguring the flow assignments from time to time can improve the latency of time-sensitive flows and can increase the number of flows embedded in the network in worst-case scenarios.

Abstract Control and user (data) plane separation (CUPS) is a concept applied in various networking areas to scale network resources independently, increase the quality of service, and facilitate the autonomy of networks. In this study, we leverage this concept to design a plane-separated routing algorithm, CUPS-based hierarchical routing algorithm (CHRA), as an energy-efficient and low-latency end-to-end communication scheme for clustered ad-hoc networks. In CHRA, while cluster heads constitute the control plane to conduct network discovery and routing, ordinary nodes residing in the user plane forward packets according to the routing decisions taken by the control plane. Exploiting the CUPS, we avoid exhausting cluster heads by offloading packet-forwarding to ordinary nodes and improve the quality of service by utilizing alternative paths other than the backbone of cluster heads. Our simulation results show that CHRA offers a better quality of service in terms of end-to-end latency and data-to-all ratio, and promotes fairness in energy-consumption in both stationary and mobile scenarios.

The IPv6 protocol will sooner or later replace IPv4 to cope with an exponentially increasing number of connected devices. Some of the most significant functions of IPv6 networks are network discovery, maintenance, and routing mechanisms to promote auto-configuration of the network with less manual effort. Network Discovery Protocol (NDP) is an important protocol in IPv6 to identify the relationships between different neighboring devices in a network. However, it is also subject to spoofing and man-in-the-middle attacks. This paper implements an attack detection and mitigation strategy called Router Advertisement Guard (RA-Guard) in P4 to defend IPv6 networks against router spoofing attacks directly on the data plane. In contrast to very few proprietary RA-Guard implementations with limited details, we consider different scenarios to exploit IPv6 packet structure and publish our implementation open-source. The experiments show that our P4-based implementation can detect and mitigate spoofing attacks leveraging RA-Guard together with its control plane extensions.

The introduction of IEEE Time-sensitive Networking (TSN) enables the design of real-time and mission-critical networks based on Ethernet technologies. Apart from providing necessary tools for near-deterministic scheduling, TSN comes with further functionalities for configurability, security, and reliability. IEEE 802.1CB Frame Replication and Elimination (FRER) is the only protocol in the TSN toolbox for adding fault-tolerance via sending the same packets via redundant paths. Although its core functions are defined by the standard, its effective use mainly depends on the actual deployment scenario and the path selection strategy. In this paper, we show that FRER can induce unintentional elimination of packets packets when the paths chosen for a particular packet flow are non-disjoint. We propose the new metric reassurance that can be used in FRER path selection. Besides, we propose an additional enhancement to FRER that can prevent unintended packet eliminations independent from the deployment scenario. Our simulation results indicate that the reassurance-based path selection performs better than random or maximum-disjoint path selection in random failure scenarios.

The convergence of Information Technology (IT) and Industrial Operations Technology (OT) results in efficient network management solutions for automotive and industrial automation environments. However, configuring real-time Ethernet networks while maintaining the desired QoS is challenging due to the dynamic nature of OT networks and the high number of configuration parameters. This paper introduces a Software-Defined Network (SDN)-based self-configuration framework for the time-sensitive networks (TSNs). Unlike standard TSN, we remove end-host-related dependencies and put streams initially on default paths to extract traffic characteristics by monitoring network traffic at edge switches. Communicated to a central SDN controller, these characteristics allow moving streams to optimal paths while maintaining hard real-time guarantees, for which we also formulate an optimization problem. According to the results, although the proposed approach increases the average delay of critical frames by less than 1%, a certain level of real-time guarantee can be provided without prior knowledge of the streams.

Mission-critical networks, which for example can be found in autonomous cars and avionics, are complex systems with a multitude of interconnected embedded nodes and various service demands. Their resilience against failures and attacks is a crucial property and has to be already considered in their design phase. In this paper, we introduce a novel approach for optimal joint service allocation and routing, leveraging virtualized embedded devices and shared backup capacity for the fault-tolerant design of mission-critical networks. This approach operates in phases utilizing multiple optimization models. Furthermore, we propose a new heuristic that ensures resource efficiency and fault-tolerance against single node and link failures as pre-requisite for resilience. Our experiments for different application scenarios indicate that our heuristic achieves results close to the optimum and provides 50% of capacity gain compared to a dedicated capacity protection scheme. Moreover, our heuristic ensures fault-tolerance against at least 90% of all potential single node failures.

Embedded IoT networks are the backbone of safety-critical systems like smart factories, autonomous vehicles, and airplanes. Therefore, resilience against failures and attacks should be a prior concern already in their design stage. In this study, we introduce a service-based network model as an MILP optimization problem for the efficient deployment of a service overlay to the embedded network by meeting QoS and resilience requirements. We show the complexity and boundaries of the problem and propose several heuristics to relax the service deployment phase and increase the fault-tolerance against node and link failures. Our results indicate that the heuristics achieve results close to the optimum for small sizes of the problem with up to 10^8 time faster solution time. We also show that the heuristics can solve larger problem sizes and can maintain the service availability for 85% of all potential single node failures.