Imagine you have a motion-sensor alarm in your house. It catches burglars, but it also goes off every time the heating kicks on and the curtains billow. You could retrain the sensor — expensive, fragile — or you could wire it to the thermostat so it knows "heating just started, expect curtain movement, raise the trigger threshold for 30 seconds." That's this paper. The thermostat is the 5G control plane. The committed claim: when industrial OPC UA traffic runs encrypted over private 5G, benign connectivity events — handovers, RRC state transitions, link re-establishments — cause observable spikes in traffic statistics that frozen anomaly-detection models misclassify as attacks. By monitoring control-plane (CP) indicators at the user equipment and constructing a temporal context window around CP activity, a CP-specific decision threshold can be applied that reduces false-positive rates without retraining the underlying models or changing any features, scores, or preprocessing. The architecture is deliberately lightweight. Four frozen IDS models (the paper doesn't name architectures in the abstract, but the approach is model-agnostic by design) produce anomaly scores from payload-agnostic statistical features — packet sizes, inter-arrival times, flow volumes — extracted from encrypted user-plane traffic. The CP-aware adaptation layer sits entirely outside the model inference path. It monitors UE-level control-plane indicators (RRC state changes, handover events), defines a temporal window around each CP event, and swaps in a CP-specific threshold calibrated on a separate adaptation validation set. Outside those windows, the original threshold applies. No gradient updates, no feature engineering, no model surgery. The evaluation runs on a real industrial private 5G testbed — not simulation, not emulation, actual hardware. The paper shows that benign connectivity variations increase the FPR for all four evaluated models and that false positives cluster within periods temporally associated with CP activity. The CP-aware adaptation reduces both the global FPR and the FPR within CP-context windows. The tradeoff is explicit and configurable: tightening the CP-context threshold reduces false positives at the cost of some recall over complete attack campaigns. The paper owns this tradeoff rather than hiding it. The ladder here is unusual. This isn't a "we beat SOTA on a benchmark" paper — it's a reliability-improvement wrapper for existing detectors. The baseline is the same four models without CP-aware adaptation, and the comparison is internal: FPR-with vs. FPR-without. There's no external competing method for this specific problem (CP-aware threshold adaptation for encrypted ICS traffic over 5G), which makes the paper more of a problem-definition contribution than a horse-race entry. The authors are essentially saying: here is a failure mode nobody was tracking, and here is a cheap fix. The integrity picture is strong on the hardware side — a real testbed with real 5G connectivity variations is a meaningful validation environment that most IDS papers never reach. The adaptation threshold is calibrated on a separate validation split, which guards against the most obvious overfitting. What's missing: the paper doesn't name specific attack types, quantify the FPR reduction in absolute numbers (in the abstract), or discuss whether the CP-context window duration was tuned post-hoc. Pre-registration is absent, and there's no independent replication. The practical milestone is deployment-readiness for encrypted ICS anomaly detection in private 5G environments. Today, encrypted OPC UA traffic makes payload inspection impossible and statistical anomaly detection unreliable due to connectivity noise. This paper moves the needle from "works in the lab with stable links" toward "works in production with real radio conditions." The next concrete step is testing across multiple 5G deployments with different radio environments, UE densities, and mobility patterns to see if the CP-context approach generalizes beyond a single testbed.
