As private 4G and 5G networks become increasingly critical for industrial applications such as smart manufacturing and autonomous systems, ensuring the security and reliability of the Radio Access Network (RAN) is essential. Traditional mobile network defenses rely heavily on centralized analysis at the core network, resulting in latency and limited scalability. To address these challenges, the Open Radio Access Network (O-RAN) architecture introduces modular and programmable components that enable security mechanisms to operate closer to the network edge. In this paper, we propose a hybrid detection framework that integrates a rule-based traffic filter at the O-CU with an intelligent xApp deployed on the Near-RT RIC. The system performs GTP decapsulation and flow-level feature extraction at the O-CU, then transmits the data to the xApp, which employs an LSTM-based detector to identify low-rate Denial-of-Service attacks. Detection results are fed back to dynamically update local filtering rules. Experimental results demonstrate that the proposed framework enables lightweight and near real-time threat mitigation, thereby reducing reliance on core-network-based analysis and enhancing the responsiveness of RAN-level defenses.
The Open Radio Access Network (RAN) represents a significant advancement in the ongoing evolution of mobile networks, transitioning from proprietary physical hardware to virtualised network functions. Open RAN advocates for a disaggregated RAN utilising commercial off-the-shelf (COTS) hardware. The O-RAN Alliance is the preeminent organisation in the Open RAN initiative, guiding the industry towards a vendor-neutral radio access network characterised by open interfaces and protocols. The introduction of RAN Intelligent Controllers (RICs) and the ability to deploy third-party services on these RICs expedite the innovation within the RAN. The two RICs, non-real-time RIC and near-real-time RIC, enhance the operation of RAN by facilitating the deployment of third-party services, either as an rApp for non-real-time RIC or as an xApp for near-real-time RIC. However, this new disaggregated and open RAN expands the threat surface and introduces novel security and privacy challenges that were previously absent, and these issues remain unaddressed. The introduction of new stakeholders, such as third-party application providers and cloud service providers, into the RAN ecosystem presents potential vulnerabilities. This paper proposes a hierarchical management strategy to tackle security challenges in Open RAN, enabling authorisation, authentication, and monitoring for third-party applications. Experimental evaluations across multiple configurations demonstrate that the proposed framework is scalable and imposes minimal overhead, making it a practical solution for securing next-generation RAN deployments.
The deployment of 5G networks and increasing virtualization of network components have expanded the attack surface of telecommunications infrastructures, requiring domain specific expertise for effective and rapid vulnerability detection and assessment. AI-based solutions could be a valid support, but any information regarding 5G configurations or infrastructure architectures is highly sensitive and often subject to data protection policy that prohibit sharing with external services, including Large Language Models (LLMs) hosted in proprietary cloud systems. On the other hand, a local LLM deployment ensures compliance with confidentiality requirements while maintaining control over critical information. Our research investigates the capabilities of LLMs, from lightweight to frontier architectures, for identifying 5G relevant Common Vulnerabilities and Exposures (CVEs), by introducing a framework that executes a multi-model evaluation with progressive prompt complexity. We validate LLM responses using a novel dataset of CVEs that we manually annotated, evaluating performance to identify models, parameters, and strategies for a practical applicability in local environments resources limited. Preliminary results show that enriching the prompt by adding more context using embeddings can lead to encouraging performance in 5G CVE classification in limited settings with models under 14 billion of parameters, indicating potential advantages compared to large and frontier models which require higher inference computational costs.
Radio Frequency Fingerprinting (RFF) enables passive device identification by leveraging hardware-induced signal distortions such as phase noise and frequency offset. This technique introduces relevant privacy risks, as passive observers can re-identify and track devices over time. To address these concerns, recent defenses have proposed injecting random noise to obscure fingerprint features and hinder classification. In this paper, we revisit the threat model from an adversarial standpoint and demonstrate that such noise-based obfuscation is fundamentally vulnerable. We introduce Echo, a lightweight signal-level attack that exploits the statistical independence of additive noise across repeated transmissions; by applying a combination of ensemble averaging with autoencoder-based reconstruction error analysis, Echo systematically suppresses obfuscating noise and restores persistent hardware signatures. We evaluate this approach on a public dataset of ten USRP transmitters under varying noise conditions and three adversarial training scenarios. Our results show that Echo achieves fingerprint recovery across 22 different test scenarios, obtaining a minimum Area Under the Curve (AUC) of 0.80. These findings expose a critical weakness in current obfuscation strategies and call for further research in the area.
Cellular networks, including 5G and 4G, use the radio resource control (RRC) communication to establish and set up the communication channel between a user equipment and a base station. We study the Wireless Blackhole threat, in which a fake base station directs multiple users to connect to itself, thereby depriving them of connectivity availability. The attacker manipulates the standardized cellular protocol by using the broadcasting control communication transmission-in contrast to the previous research targeting a single victim using unicast transmission-hence the name Blackhole. The Wireless Blackhole threat directs the victims' connections to the attacker itself, unlike jamming triggering the victims to avoid the attacker/channel. The threat is effective against user equipment both during connection initiation and when idle with an existing connection, and the threat impact range depends on the attacker's transmission power. Informed by the threat and vulnerability analyses, we design and build a distributed edge defense which detects and recovers from the threat. To enable such defense, our defense leverages a whitelist of the registered base stations (e.g., our implementation is based on that published by FCC) and utilizes a distributed, out-of-band, and offline delivery of the list via blockchain. We implement the Wireless Blackhole threat and defense on software-defined radios and validate and evaluate it against both a srsRAN-based user equipment and mobile phones connected to real-world cellular operators. We facilitate further R&D to secure the cellular networking against fake base station and discuss future directions, including those which can add to our defense but require changes in the cellular infrastructure.
