Production downtime and security risks caused by attacks on time-sensitive networks (TSN)

Industry 4.0 applications – ranging from robotics and production lines to distributed sensor networks – require reliable, time-synchronised communications solutions such as TSN. Time-sensitive networks (TSN) operate like a precise clockwork mechanism: All devices on the network have the same understanding of time and follow the same rules for processing and forwarding network packets, as well as for selecting and reserving bandwidth and communications paths. This ensures that every message reaches its destination at exactly the right time. Delays, or so-called latencies, in message transmission are known and are taken into account when synchronising communications. 

A successful cyber attack on such networks can not only cause production downtime but, depending on the area of application, may also endanger people’s safety. 

Therefore, IMMS is developing a comprehensive AI-based attack protection system for TSN in the SecureTSN project. The aim is to ensure that this does not reduce production speed without causing any additional overhead.

Insecurity of old stand-alone solutions 

Currently, in many cases, heterogeneous fieldbus systems such as PROFINET, EtherCAT, Ethernet/IP, Modbus or CANopen are still used to connect sensors and actuators to an automation device in industrial automation solutions. These systems are part of operational technology (OT) networks, which are usually designed for the long term and are used to control physical processes such as machines, plant or sensors in industry. Many of them are older systems tailored to a specific application.

The resulting isolated networks not only prevent interoperability, but also increase vulnerability to cyber-attacks. 

TSN as a solution – protective shield to be further expanded 

To counteract this, IT and OT networks are increasingly being converged using time-sensitive networking (TSN). TSN ensures deterministic latencies, guaranteed quality-of-service and high availability. However, a comprehensive security architecture is still lacking.

SecureTSN project strengthens security architecture

The SecureTSN project addresses this gap. The aim is to provide hardware and software extensions that protect TSN networks against deception, manipulation and denial-of-service attacks, in which targets are overloaded. In doing so, the project focuses on the critical TSN functions of time synchronisation (IEEE 802.1AS) and scheduling (IEEE 802.3Qbv).

IMMS is developing the key AI-based anomaly detection component

Within the project, IMMS is working on the development and integration of AI-based attack detection systems into TSN-compatible devices. IMMS utilises its TSN test laboratory and expertise in embedded systems to train machine learning models that detect time-series anomalies – in particular delay attacks – in real time. The models are then optimised for deployment on microcontrollers and edge switches. This compact, hardware-close implementation will be embedded in switches and end devices, enabling them to continuously monitor network traffic, immediately report potential attacks and, where necessary, trigger countermeasures. Through this combination of model training, optimisation and hardware integration, IMMS provides the central anomaly detection component that strengthens the security of the entire TSN infrastructure.

Validation with demonstrator

The results will be validated in a test and demonstration setup that will show the security of TSN switches, end devices and switched end devices under real-world attack conditions. By combining standardised security profiles, hardware security functions and intelligent monitoring software, we are increasing the acceptance of TSN among SMEs, enabling faster time-to-market and strengthening the resilience of industrial manufacturing and automation networks.