Antifragile OT Network Topologies: Convex Response to Adversarial Shock and Self-Stabilizing Microgrids

J. McKenney

This is a standalone treatise in the Digital Twin working group rather than an entry in a numbered series. It shares its subject with WG-02-DT-Tier-Redundancy-Common-Mode-Failures, which is also published: that paper diagnoses why identical redundant controllers fail together under a shared-firmware exploit, and this paper proposes the self-rewiring topology that responds to the same failure mode by gaining defensive capability from the shock rather than merely surviving it.

Licence: CC BY 4.0. 17 September 2026.

Executive Abstract#

Industrial control systems are usually built to survive a fixed amount of damage: two of everything, or one spare for every unit in service, behind a fixed perimeter. The blind spot is that if the spare and the primary run the same software, one exploit breaks both at once, and the redundancy buys nothing against that attack.

The paper borrows Taleb's idea of systems that improve under stress rather than resist it, and asks what a topology needs to get stronger when attacked. It develops a network that rewires its own connections during an intrusion, isolating the affected part and reconfiguring the rest, using differential game theory and an Ising physics model of coupled systems. The isolating move is an autopoietic bulkhead: the moment an anomaly appears on a node, its couplings drop to zero and the malware front halts at the boundary.

The central claim is that this self-rewiring contains a compromised part of the network in well under a second, before an operator would have time to see the alert, while the hard safety limits required by functional-safety standards stay intact throughout. It is tested on a standard 33-bus distribution feeder model rather than a live plant, so the result should be read as a demonstrated mechanism, not an operational track record.

Abstract#

McKenney establishes the mathematical theory and operational architecture of antifragile operational technology (OT) network topologies. Industrial control systems have been designed around static perimeter boundaries, rigid Purdue hierarchies, and simple N+1 or 2N hardware redundancy. Following Taleb's formulation of non-linear payoffs, systems that cannot adapt to disorder become catastrophically fragile under rare, high-impact adversarial shocks (Black Swans). The treatise formulates a dynamic, self-rewiring topology governed by differential game theory and Ising spin-coupling surgery, classifying architectures by the second derivative of capability with respect to stress: negative fragile, zero resilient, positive antifragile. The defender minimizes the graph's spectral radius while spawning decoy honeypots, so the incentive to deceive grows with attack intensity and the payoff turns convex. An autopoietic bulkhead drives compromised couplings to zero, decoupling the Ising Hamiltonian so the infected node flips freely without magnetizing its neighbors. On an IEEE 33-bus distribution feeder digital twin under an Industroyer-style campaign, the fabric contains lateral movement to one node in 218 milliseconds, holds power interruption at zero, and records a convexity parameter of +4.12, against roughly $1.85 million in loss for the static baseline. Safety instrumented loops under IEC 61508 remain hardwired invariants excluded from rewiring, with actuation completing in 180 to 240 milliseconds inside process safety times.

1. Introduction#

From Fragile Redundancy to Antifragile Adaptation

For decades, industrial automation standards (such as IEC 62443, ISA-99, and the classic Purdue Enterprise Reference Architecture) have prescribed static network segmentation. Facilities partition operational assets into fixed zones connected by physical firewalls, establishing conduit rules that remain unchanged for years. Hardware redundancy is added in parallel: duplicate power supplies, redundant programmable logic controllers (PLCs), and dual-ring Ethernet networks (such as IEC 62439-3 PRP/HSR).

While this static redundancy protects against predictable, independent mechanical wear and tear, it creates systemic fragility against intelligent, adaptive adversaries:

1. Deterministic Lateral Movement: Once an adversary penetrates the outer firewall (e.g., via compromised VPN credentials, infected contractor laptops, or supply chain backdoors), the internal topology is completely stationary. The attacker can map assets, enumerate Modbus or CIP endpoints, and establish persistent command-and-control without facing unexpected structural obstacles.
2. Cascading Control Plane Collapse: Redundant controllers share identical firmware, identical operating systems, and identical network conduits. Under a zero-day exploit or distributed denial-of-service (DDoS) storm, both primary and backup controllers succumb simultaneously: a catastrophic common-mode failure.
3. Rigid Blast Radii: Traditional firewalls enforce binary decisions: allow or drop. Under attack, operators face a false dilemma: leave the network open and risk physical sabotage, or pull physical network cables, triggering uncontrolled process trips and millions of euros in downtime.

To transcend these limitations, we formalize an Antifragile OT Network Topology. An antifragile network does not merely resist stress or bounce back to its original configuration (the definition of engineering resilience). Instead, it dynamically restructures its communication graph in response to adversarial pressure, systematically increasing the attacker's work factor while autonomously preserving safety-critical physical processes.

2. Mathematical Definition of Antifragility in Network Graphs#

2.1 The Payoff Function Under Stress#

Following Taleb's mathematical formulation of convexity, let $S \in [0, 1]$ denote the normalized intensity of external stress, perturbation, or adversarial attack applied to a network graph $\mathcal{G} = (\mathcal{V}, \mathcal{E})$. Let $\mathcal{R}(S)$ denote the systemic robustness or net operational capability of the industrial facility.

We categorize network architectures into three distinct mathematical regimes based on the second derivative of the performance function with respect to stress:

2.2 The Differential Rewiring Game#

Let $\mathbf{A}(t) \in \mathbb{R}^{N \times N}$ denote the time-varying adjacency matrix of the communications network, where $A_{ij}(t) > 0$ indicates an active communications conduit between asset $i$ and asset $j$.

The topological evolution of the network is modeled as a continuous-time differential game between two agents:

1. The Attacker (Red): Seeks to maximize malware diffusion velocity across the graph, which is governed by the spectral radius (largest eigenvalue) $\rho(\mathbf{A}(t)) = \lambda_{\max}(\mathbf{A}(t))$ and the epidemic reproduction ratio $R_0 = \rho(\mathbf{A}) \frac{\beta}{\gamma}$.
2. The Defender (Blue): Seeks to minimize spectral radius $\rho(\mathbf{A}(t))$ while maximizing process availability and deceptive entropy through dynamic honeypot instantiation.

The dynamical system governing the adjacency matrix is:

Where $\Omega$ is the deterministic control policy and $\mathbf{\Xi}(t)$ is a stochastic perturbation matrix.

The Defender solves the instant optimization problem at each control epoch:

Where:

• $W_{ij}$ represents the operational cost of severing conduit $(i, j)$ (e.g., $W_{ij} \to \infty$ for safety-critical protection interlocks).
• $\mathcal{H}_{\text{decoy}}$ is the Shannon entropy of the deceptive decoy distribution across the network.
• $\mu_{\text{decoy}} \cdot S(t)$ ensures that as attack stress $S(t)$ increases, the incentive to generate deceptive honeypots grows proportionally, creating a convex payoff.

3. Autopoietic Bulkheading via Ising Coupling Surgery#

3.1 Network as an Ising Spin System#

To model the rapid phase transition between a secure plant and a compromised plant, we map the network to a statistical-mechanical Ising spin lattice:

Where:

• $\sigma_i \in \{+1, -1\}$ denotes the operational state of asset $i$ ($-1$ indicates healthy, $+1$ indicates compromised/infected).
• $J_{ij} \ge 0$ represents the cyber-physical coupling strength between assets $i$ and $j$.
• $h_i$ represents the external attack stimulus (e.g., active vulnerability scanning or phishing payload delivery targeting asset $i$).

In an untreated network, when external stimulus $h_i$ exceeds the local threshold $\phi_i$, spin $\sigma_i$ flips to $+1$. The ferromagnetic coupling $J_{ij}$ transmits a magnetic field to neighboring nodes, initiating a discontinuous first-order phase transition (a catastrophic malware cascade).

3.2 Coupling Surgery#

An Autopoietic Bulkhead executes instantaneous coupling surgery on the communication manifold. The moment an anomaly is detected on node $k$:

By driving coupling $J_{kj}$ to zero, the Hamiltonian decouples:

The infected node can undergo unbounded spin flips ($\sigma_k = +1$) without transmitting energy or magnetization to the rest of the lattice. The propagation front is halted at the boundary in zero thermodynamic work.

4. Preservation of Functional Safety and IEC 61508 Envelopes#

A primary obstacle to adopting dynamic network reconfiguration in industrial settings is the strict deterministic timing mandate of Functional Safety Standards (IEC 61508, IEC 61511, and ISO 13849).

4.1 Separation of Safety and Control Planes#

In our antifragile architecture, autonomous rewiring is strictly partitioned across operational planes:

1. Safety Instrumented System (SIS) Plane (Purdue Level 0/1): Dedicated physical fiber loops running IEC 61784-3 (Safety-over-EtherNet/IP, PROFIsafe, or openSAFETY). These channels are hardwired invariants: their coupling $J_{ij}^{\text{safety}}$ is permanent and mathematically excluded from the SDN rewiring engine ($W_{ij} \to \infty$).
2. Basic Process Control System (BPCS) Plane (Purdue Level 2): Real-time process monitoring (Modbus/TCP, EtherNet/IP, PROFINET). Rewiring is permitted only within pre-verified deterministic route sets.
3. Supervisory & Operations Plane (Purdue Level 3/3.5): Engineering workstations, Historians, and SCADA servers. Rewiring and decoy instantiation operate without constraints.

4.2 Bounded Safety Response Time (SRT)#

For any conduit in the BPCS plane subject to autopoietic reconfiguration, the worst-case network convergence time $T_{\text{rewire}}$ must satisfy:

Where:

• $\text{SRT}$ is the Safety Response Time of the control loop.
• $\text{PST}$ is the Process Safety Time (the physical duration between a process runaway initiating and a catastrophic physical containment failure).

In modern chemical and power generation plants, typical Process Safety Times range from $500 \text{ ms}$ (compressor surge) to several seconds (furnace overheating). Because our OpenFlow/P4 SDN actuation completes in $180 \text{ to } 240 \text{ ms}$, the antifragile reconfiguration is guaranteed to settle well within the process safety margin.

5. The Five-State Autopoietic Reconfiguration Lifecycle#

The dynamic network fabric transitions through a formal finite state machine designed with mathematical hysteresis to prevent control plane oscillations or route flapping.

State Definitions#

1. State 1: Baseline Equilibrium: The network operates under its nominal, highly optimized routing topology. Communication flows along shortest-path spanning trees to minimize latency.
2. State 2: Perturbation Sensing: Edge sensors detect localized anomalies (e.g., packet rate spikes, unauthorized protocol function codes, or elevated round-trip times). Stress metric $S_i(t)$ rises.
3. State 3: Convex Bulkheading: When stress crosses confirmation threshold $\tau_{\text{confirm}}$, the SDN controller executes targeted coupling surgery. The affected asset is isolated from operational conduits within $<300 \text{ ms}$.
4. State 4: Decoy Swarm Entrapment: High-interaction virtual machine containers (honeypots) are spawned instantaneously on the vacated IP addresses. The attacker's exploit payloads are absorbed, logged, and analyzed in an isolated sandbox.
5. State 5: Hysteresis Reconvergence: After the asset is cleansed, firmware integrity is attested via cryptographic TPM measurements, and a hold timer $T_{\text{hold}}$ expires without secondary flare-ups, the SDN controller smoothly restores the primary communication paths.

6. Empirical Case Study#

IEEE 33-Bus Industrial Distribution Feeder

We evaluate the antifragile topology architecture on an operational digital twin of an IEEE 33-Bus Industrial Distribution Substation Feeder powering a multi-tenant manufacturing campus.

6.1 Test Setup#

• Topology: 33 electrical buses, 32 distribution lines, 5 distributed generation inverters (PV + BESS), and 33 interconnected protection IEDs.
• Attack Vector: BlackEnergy3 / Industroyer-style coordinated malware campaign. The attacker compromises an engineering laptop at Bus 7 and attempts to flood IEC 60870-5-104 breaker trip commands across all downstream feeder nodes (Buses 8 through 18).

6.2 Comparative Performance#

We compare three architectural paradigms under the identical attack scenario:

• Architecture A (Static Purdue Model): Traditional fixed firewalls between IT and OT; unsegmented internal switch fabric.
• Architecture B (Resilient PRP Dual-Ring): Parallel physical network rings with static duplicate packet transmission.
• Architecture C (Antifragile Autopoietic Topology): Dynamic SDN-actuated topology with real-time coupling surgery and decoy swarming.

Under Architecture A (blue curve), availability collapses catastrophically once attack stress exceeds $S = 0.4$, demonstrating classical fragility. Under Architecture B (purple curve), redundant hardware delays the collapse but remains linear and vulnerable. Under Architecture C (green curve), the antifragile autopoietic fabric maintains over $98.5\%$ process availability even under maximal attack stress ($S = 1.0$), while safely sequestering the malicious traffic into honeypots.

7. Conclusion & Research Directives#

Static defense is an obsolete paradigm for industrial control systems. When faced with asymmetric, intelligent adversaries, attempting to make an immovable perimeter ever more impenetrable only increases the catastrophic consequences of the inevitable breach.

By implementing an Antifragile OT Network Topology, infrastructure operators achieve:

1. Mathematical Convexity: Systemic security posture improves as adversarial stress increases ($f''(S) > 0$).
2. Sub-Second Autopoietic Containment: Coupling surgery isolates compromised nodes within $<300 \text{ ms}$, terminating lateral spread before human incident responders could even open an alert ticket.
3. Provable Safety Invariance: Physical safety instrumented loops (IEC 61508) are preserved with zero packet jitter, strictly bounding network convergence times within Process Safety Times.

Future research under Working Group WG-02 will expand this model to Decentralized Multi-Agent Swarm Bulkheading, allowing edge switches and IEDs to coordinate autonomous coupling surgery locally using consensus algorithms without requiring centralized SDN controller reachability.

8. References#

1. Taleb, N. N. (2012). Antifragile: Things That Gain from Disorder. New York: Random House.
2. McKenney, J. (2026). Tier Classification, Redundancy Topologies & Common-Mode Failures. Eigenia Research Working Group WG-02 Treatise WG-02-DT-Tier-Redundancy-Common-Mode-Failures.
3. McKenney, J. (2026). Concept of Operations (ConOps) & Minimum Operating Requirements (MoR). Eigenia Research Working Group WG-01 Treatise WG-01-UI-Concept-of-Operations-Minimum-Operating-Requirements.
4. Maturana, H. R., & Varela, F. J. (1980). Autopoiesis and Cognition: The Realization of the Living. Dordrecht: D. Reidel Publishing Company.
5. International Electrotechnical Commission. (2010). IEC 61508: Functional safety of electrical/electronic/programmable electronic safety-related systems. Geneva: IEC.
6. International Electrotechnical Commission. (2016). IEC 61511: Functional safety - Safety instrumented systems for the process industry sector. Geneva: IEC.
7. International Electrotechnical Commission. (2018). IEC 62443: Security for industrial automation and control systems. Geneva: IEC.
8. Barabási, A. L. (2016). Network Science. Cambridge: Cambridge University Press.
9. Granovetter, M. (1978). Threshold models of collective behavior. American Journal of Sociology, 83(6), 1420-1443.
10. McKeown, N., et al. (2008). OpenFlow: enabling innovation in campus networks. ACM SIGCOMM Computer Communication Review, 38(2), 69-74.