Validate BALLAST on industrial network hardware and physical PLCs

Validate the BALLAST Digital Twin-guided moving-target defense, including its Make-Before-Break handover, on industrial Ethernet switches and physical PLCs rather than only in Mininet emulation.

Background

The evaluation uses software Open vSwitches and simulated PLC processes in Mininet. The paper identifies hardware-specific problems that may invalidate the emulation results, including low-priority flow-rule performance degradation, divergence between control-plane acknowledgments and data-plane installation, and transition packet loss.

Because BALLAST depends on concurrent high- and low-priority rules during connection draining, deployment feasibility depends on the behavior of particular switch and firmware combinations. The paper explicitly treats validation on real hardware as a prerequisite rather than as a completed refinement.

References

Critical disclosure. Our evaluation runs entirely inside Mininet. We have not validated Ballast on industrial Ethernet switches or on physical PLCs.

— BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle  (2610.18311 - Mogollon-Gutierrez et al., 13 Oct 2026) in Section 5.6.4, subsection “Hardware Deployment Feasibility,” and Section 5.7, subsection “Emulation rather than hardware, and a priority-dependent protocol”