Pith. sign in

REVIEW 4 major objections 5 minor 38 references

ARGOS: Anomaly Recognition and Guarding through O-RAN Sensing

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A variational autoencoder running inside the O-RAN RIC detects rogue base stations with 99.5% accuracy and only 0.6% false positives.

desk verdict Useful dataset and a clean anomaly-detection pipeline, but the real-time RBS downgrade claim collapses on the ML1 availability gap and the post hoc label threshold. read the letter →

arxiv 2506.06916 v1 pith:ZZG2223P submitted 2025-06-07 cs.NI cs.CR

Stavros Dimou , Guevara Noubir This is my paper
classification cs.NIcs.CR
keywords 5GsecurityO-RANroguebasestationdowngradeattackanomalydetectionvariationalautoencoderxAppUEtelemetry
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ARGOS is an intrusion-detection system that lives inside the O-RAN Near-Real-Time RIC—the controller that hosts modular apps on sub-second timescales—and tries to catch rogue base stations attempting downgrade attacks on 5G/LTE users. Its central claim is that ordinary per-second measurements from phones—cell identities, signal power, quality, and SINR—carry enough information for an unsupervised autoencoder to distinguish a legitimate radio neighborhood from one containing an impostor cell, even when the impostor clones a legitimate cell's ID. The paper validates this with an O-RAN testbed plus 22,626 seconds of telemetry collected from commercial networks in two U.S. cities. The best model, a variational autoencoder, reaches 99.5% accuracy, 97.7% precision, 99.5% recall, and a 0.6% false-positive rate when a rogue cell appears at least three times in a one-second window, with inference fast enough for real-time use. If correct, this gives operators a concrete, standards-aligned path to real-time rogue-base-station warnings without requiring labeled attack data.

What carries the argument

The load-bearing object is the per-second telemetry vector produced by ARGOS's extension of the KPM service model. Each vector encodes the presence or absence of every cell a UE saw during that second, identified by ARFCN and PCI, together with normalized RSRP, RSRQ, and SINR measurements. The variational autoencoder maps these vectors to a low-dimensional latent space and reconstructs them; a rogue cell that appears repeatedly in a second disrupts the learned co-occurrence pattern and pushes the mean-squared reconstruction error above the threshold set at the 99.9th percentile of training errors. Retraining every 10 seconds keeps the threshold adapted to slow radio changes. This design converts a sparse, event-triggered measurement stream into a dense, continuous anomaly score.

What would settle it

Run ARGOS on the same testbed and dataset but feed it only the over-the-air Measurement Reports, omitting all modem-layer logs, and compare the detection metrics; if accuracy drops sharply, the deployed system relies on a data source current O-RAN interfaces cannot deliver. A second check is to attempt to collect the same per-second enriched telemetry from an unmodified commercial phone using only network-side collection; if that fails, the architecture cannot be deployed as written.

Watch

Extended reading notes

Core claim

ARGOS claims to be the first O-RAN-compliant system aimed specifically at detecting rogue base stations that launch downgrade attacks. It extends the 3GPP Key Performance Measurement (KPM) service model—the standard channel for carrying RAN performance reports—so that the near-real-time RIC receives per-UE telemetry vectors built from Measurement Reports and modem-layer logs; each one-second vector records which cells (identified by radio-frequency channel number ARFCN and physical cell ID PCI) were observed together with normalized RSRP, RSRQ, and SINR. An unsupervised variational autoencoder learns the normal joint pattern of these vectors from legitimate data alone, and flags any second whose reconstruction error exceeds the 99.9th percentile of training errors. Evaluated by holding out a legitimate cell and reintroducing it as a rogue—once with a fresh PCI and once with a cloned PCI—the VAE reaches 99.5% accuracy, 97.7% precision, 99.5% recall, and a 0.6% false-positive rate at a per-second rogue count of three or more. The system retrains every 10 seconds on newly accumulated legitimate telemetry so the anomaly baseline tracks changes in the radio environment.

Load-bearing premise

The load-bearing premise is that the enriched telemetry ARGOS depends on—especially the modem-layer measurements that give it fine-grained neighboring-cell data—can actually reach the Near-RT RIC in real time, even though those modem-layer measurements are generated only inside the phone and are not transmitted over the air by today's commercial devices.

Editorial extensions

If this is right

  • An xApp in the Near-RT RIC can serve as an always-on watchdog for downgrade attacks, converting ordinary UE measurements into an anomaly score without any labeled attack data.
  • The extended KPM service model provides a reusable telemetry channel that other RIC applications could exploit for richer per-UE visibility.
  • A VAE-based detector can make a per-second decision in about 0.27 seconds of inference and retrain in about 82 seconds, making production deployment computationally feasible.
  • The same approach catches both novel-PCI rogues and harder PCI-cloning rogues, because the cloned cell still creates unusual combinations in the per-second vectors.
  • Operators can tune the per-second rogue-cell count threshold to trade precision for recall depending on their tolerance for false alarms.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The detection signal is essentially co-occurrence: any sudden new cell identity, not just a downgrade attacker, disturbs the learned vector pattern, so the same machinery could plausibly apply to jamming, spoofing, or coverage-anomaly detection with little modification.
  • Because the model retrains every 10 seconds on current telemetry, a rogue that appears rarely or at very low power could gradually be absorbed into the definition of normal; freezing the baseline on verified-good periods or capping the retraining window would be a natural hardening.
  • The real deployability test is the modem-layer feed: if a future O-RAN interface or a UE-side agent can stream modem-layer measurements to the RIC, ARGOS's enriched telemetry becomes practical; without such a channel, the system would have to rely on sparser over-the-air Measurement Reports.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes ARGOS, an O-RAN-compliant intrusion detection system deployed as an xApp in the Near-RT RIC, intended to detect rogue base station (RBS) downgrade attacks in real time. ARGOS collects per-second UE telemetry from Measurement Reports and Modem Layer 1 (ML1) logs through an extended KPM Service Model, and applies unsupervised autoencoder-based anomaly detection. The system is implemented in a testbed using Open5GS, srsRAN, and FlexRIC, and evaluated on a real-world dataset collected from commercial networks in Boston and San Francisco. The authors report that a Variational Autoencoder achieves 99.5% accuracy, 97.7% precision, 99.5% recall, and 0.6% false positive rate. The paper also presents system overhead measurements for the xApp models.

Significance. If valid, the work would address an important and underexplored problem: using O-RAN programmability to detect RBS downgrade attacks. The construction of a dedicated testbed and the collection of a substantial real-world dataset (22,626 seconds, 232,810 points) are genuine strengths, as is the attempt to evaluate performance under realistic signal conditions rather than relying solely on synthetic data. However, the central claim of real-time RBS detection is not supported by the evaluation. The ground-truth labels are constructed from the same telemetry features the models are designed to detect, the RBS emulation does not reproduce adversary behavior, and a key data source (ML1) is admitted to be unavailable to the RIC. The underlying ML machinery (autoencoders for novelty detection) is standard, and the paper does not demonstrate that it offers advantages over simple rule-based baselines. As a security deployment, the contribution is therefore not demonstrated; what remains is a proof-of-concept for offline cell-appearance detection using UE logs.

major comments (4)
  1. [Section V-D (Per-Second Rogue Cell Count) and Figure 5] The evaluation is circular. The ground-truth label for each per-second vector is defined by the number of times the reintroduced cell appears in that vector: the text states that vectors in which the reintroduced rogue cell appears at least 2, 3, or 4 times are considered anomalous. This label is a direct function of the input features (cell presence counts) used by the anomaly detection model. A model trained on legitimate telemetry without that specific cell will trivially assign high reconstruction error to any vector containing it, so the reported 99.5% accuracy is an artifact of how the labels are defined rather than evidence of RBS detection capability. Additionally, the threshold of ≥3 is selected post hoc after observing that it yields the best balance of metrics; no pre-registered criterion or theoretical justification is provided, which inflates the apparent performance.
  2. [Section V-B (ML1 data limitation) and Section IV-B (Architecture)] The paper's core assumption about data availability is internally inconsistent with its own description. Section V-B states that ML1 data "are never transmitted to the gNB over the air (OTA) and remain accessible only at the UE side," yet Algorithm 1 and Section IV-B assume per-second telemetry vectors containing ML1-derived measurements reach the xApp via E2/KPM Report indications. The abstract and Section VII repeat that ARGOS operates on "solely UE ML1 logs and Measurement Reports" in real time. No O-RAN-compliant mechanism is specified or demonstrated for conveying ML1 logs from a COTS UE to the Near-RT RIC; QXDM extraction is offline and UE-side. The testbed uses srsRAN and FlexRIC but does not show any E2 indication carrying ML1 fields. Consequently, the high-frequency per-second telemetry that underlies the reported accuracy cannot flow to the deployed xApp, so the real-time detection claim relies on a data source the authors concede is unavailable.
  3. [Section V-C (Rogue Cell Inclusion) and Section IV-A (Threat Model)] The emulation of an RBS by selecting a legitimate cell, excluding it during training, and reintroducing it during inference does not reproduce the behavior of a rogue base station in a downgrade attack. A real RBS impersonates a legitimate network or uses malicious signaling to force the UE to downgrade; it is not merely a previously unseen legitimate cell. The paper's A2 scenario reuses the same PCI as a legitimate cell, but because the underlying cell is still a legitimate cell, the test measures detection of a known cell reappearing after an absence, not detection of an adversarial transmitter with a different RF profile or behavior. The threat model in Section IV-A specifically discusses attacks that reuse a PCI to impersonate a cell, but the evaluation does not generate such an attack; the testbed demonstration in Section V-A is performed separately and is not integrated with the ML evaluation. Thus the experimental results do not validate detection of downgrade attacks or RBS impersonation.
  4. [Algorithm 1 and Section V-D (system performance)] The retraining strategy in Algorithm 1 is not consistent with the reported system overhead. Algorithm 1 states that the model is retrained every 10 seconds of accumulated telemetry, but Table II reports that the VAE takes 81.99 seconds to train on 2000 seconds of data. The xApp cannot retrain on a 10-second sliding window within a real-time control loop. The paper does not discuss this mismatch or describe how training is scheduled in practice. The overhead measurements in Table II are also computed on a separate dataset partition from the detection evaluation, so it is unclear how they relate to the actual system behavior.
minor comments (5)
  1. [Throughout] There are several formatting inconsistencies, such as "V AE" with a space in the abstract and Section IV-C, and "F alse Positives" in the abstract. These should be corrected.
  2. [Section III-A] The background section promises a description of both 5G and LTE network operations, but the text focuses almost entirely on 5G SA procedures. A brief description of LTE-specific procedures relevant to downgrade attacks (e.g., inter-RAT handover, LTE Attach) would improve readability.
  3. [Section V-A] The testbed description mentions "the latest version of the br-flexric branch of FlexRIC" without a version number or commit identifier, which limits reproducibility. The paper would benefit from pinning specific versions of all software components.
  4. [Section V-D and Table II] The paper does not provide the code or the dataset, nor a detailed description of the hyperparameters used for the autoencoders and the Isolation Forest. Without this information, the results cannot be reproduced or compared with future work.
  5. [Section V-D] No comparison is made to simple rule-based baselines, such as "flag any vector that contains a cell not present in the training set." Such a baseline would help the reader understand whether the learned model provides any advantage over a trivial detection heuristic.

Circularity Check

1 steps flagged · score 6.0 of 10

Evaluation labels are constructed from the same telemetry stream the model is tested on, and the reported 99.5% accuracy partly restates the post-hoc per-second rogue-cell-count labeling rule rather than an external benchmark.

  1. fitted input called prediction [Section V-C, V-D]
    "Since the dataset contains only legitimate data, two types of RBS strategies, Adversary 1 (A1) and Adversary 2 (A2), are emulated by selecting a valid cell, excluding it during training, and reintroducing it during inference. ... we consider as anomalous those per-second vectors in which the reintroduced rogue cell appears more than a certain number of times, while the remaining vectors are considered legitimate."

    The anomaly labels are not independent ground truth: they are defined by counting appearances of the excluded-then-reintroduced cell in the exact per-second telemetry vectors that the model also receives as input. Selecting the threshold (>=3) after observing which threshold maximizes Accuracy/Recall/F1 means the headline 99.5% Accuracy, 99.5% Recall, and 0.6% FPR are partly a restatement of the labeling rule (the threshold was chosen to make the model look best), not a measure of detecting a genuinely novel rogue-cell RF signature. The model is essentially being rewarded for learning the co-occurrence pattern that the labeler hard-coded.

full rationale

The paper's central detection claim reduces, at evaluation time, to a self-defined labeling rule. Legitimate-only data are converted into attack data by removing one valid cell during training and re-inserting it at inference; a per-second vector is then labeled anomalous iff that same cell appears at least k times, with k varied over {2,3,4} and k=3 selected post hoc as the best operating point. Because the label and the model input are drawn from the same telemetry stream (the reintroduced cell's presence count), the reported 99.5% Accuracy / 99.5% Recall / 0.6% FPR largely restate the threshold choice rather than an external, held-out measure of RBS detection. This is pattern 2 (fitted input called prediction) with elements of pattern 1 (self-definitional labeling). Separately, the deployment claim is internally inconsistent rather than circular: Section V-B concedes ML1 data 'are never transmitted to the gNB over the air (OTA) and remain accessible only at the UE side,' while the abstract and Section VII claim real-time Near-RT RIC classification 'based solely on UE ML1 logs and Measurement Reports.' No O-RAN-compliant delivery path for ML1 to the RIC is implemented or specified; this breaks the real-time claim but is a feasibility gap, not a circularity. There is no significant self-citation load-bearing chain in the derivation; the KPM Service Model extension and the VAE architecture are standard and independently specified. The circularity score is therefore substantial but not total: the model architecture and testbed are real, and the system could be re-evaluated against genuinely independent attack data, but as reported the headline evaluation metric is forced by the labeling construction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

ARGOS is an empirical ML system, so the ledger records the evaluation premises rather than mathematical axioms. The two load-bearing assumptions are that a legitimate cell excluded from training and reintroduced at inference is a valid stand-in for a rogue base station, and that ML1 logs can reach the RIC despite never being transmitted over the air. The free parameters are the anomaly threshold, the post hoc per-second count threshold used to label ground truth, and undisclosed model hyperparameters.

free parameters (3)
  • Anomaly threshold tau = 99.9th percentile of training MSE
    Set from training data; directly controls false positive rate and detection sensitivity.
  • Per-Second Rogue Cell Count label threshold = >=3 appearances per second
    Selected post hoc from Figure 5; determines ground-truth labels and reported accuracy.
  • VAE/DAE/AE architecture hyperparameters = Not reported
    Layer sizes, latent dimension, learning rate, epochs, and DAE noise sigma are not disclosed, so these ad hoc choices are unaccounted for.
assumptions (4)
  • ad hoc to paper Emulating an RBS by excluding and reintroducing a legitimate cell is representative of real rogue base station behavior.
    Section V-C reintroduces real cells as 'rogue' cells; no actual RBS RF transmission is used in the detection evaluation.
  • ad hoc to paper ML1 logs can be delivered to the Near-RT RIC in real time on COTS UEs.
    Section V-B states ML1 data 'remain accessible only at the UE side'; no O-RAN-compliant delivery mechanism is specified.
  • domain assumption Per-second telemetry vectors encoding cell presence (ARFCN, PCI, RSRP, RSRQ, SINR) capture enough discriminative signal to separate benign and malicious cell activity.
    The entire ML pipeline operates on these hand-crafted per-second vectors (Algorithm 1); no evidence is given that these features suffice for real RBS behavior.
  • domain assumption A trustworthy corpus of attack-free telemetry is available for training and retraining.
    Algorithm 1 retrains every 10 seconds on 'legitimate telemetry' with no mechanism to guarantee absence of ongoing attacks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ARGOS: Anomaly Recognition and Guarding through O-RAN Sensing." pith.science (2026). https://pith.science/paper/ZZG2223P

@misc{pith2026250606916,
  author       = {Pith},
  title        = {Pith review of: ARGOS: Anomaly Recognition and Guarding through O-RAN Sensing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZZG2223P}},
  note         = {Machine review of arXiv:2506.06916}
}
read the original abstract

Rogue Base Station (RBS) attacks, particularly those exploiting downgrade vulnerabilities, remain a persistent threat as 5G Standalone (SA) deployments are still limited and User Equipment (UE) manufacturers continue to support legacy network connectivity. This work introduces ARGOS, a comprehensive O-RAN compliant Intrusion Detection System (IDS) deployed within the Near Real-Time RIC, designed to detect RBS downgrade attacks in real time, an area previously unexplored within the O-RAN context. The system enhances the 3GPP KPM Service Model to enable richer, UE-level telemetry and features a custom xApp that applies unsupervised Machine Learning models for anomaly detection. Distinctively, the updated KPM Service Model operates on cross-layer features extracted from Modem Layer 1 (ML1) logs and Measurement Reports collected directly from Commercial Off-The-Shelf (COTS) UEs. To evaluate system performance under realistic conditions, a dedicated testbed is implemented using Open5GS, srsRAN, and FlexRIC, and validated against an extensive real-world measurement dataset. Among the evaluated models, the Variational Autoencoder (VAE) achieves the best balance of detection performance and efficiency, reaching 99.5% Accuracy with only 0.6% False Positives and minimal system overhead.

Figures

Figures reproduced from arXiv: 2506.06916 by the authors.

Figure 1
Figure 1. RRC state transitions and Measurement Reports. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 1
Figure 1. (1) the UE, typically a smartphone equipped with a [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 3
Figure 3. Even if an RBS mimics the PCI of a legitimate cell, it cannot replicate the RF propagation profile observed by all UEs. These measurements are [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 3
Figure 3. Figure 3: Before being passed to the models for evaluation, [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]
Figure 4
Figure 4. Figure 4: UE Modem Layer 1 (ML1) Cell Measurements captured via QXDM. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: ML model inference performance across rogue cell appearance [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 38 canonical work pages

  1. [1]

    https://www.ookla.com/articles/5g-global-reach-2025

    work page 2025

  2. [2]

    https://www.ericsson.com/en/reports-and-papers/mobility-report/ reports/november-2024

    work page 2024

  3. [3]

    Never let me down again: Bidding-down attacks and mitigations in 5g and 4g

    Bedran Karakoc, Nils F ¨urste, David Rupprecht, and Katharina Kohls. Never let me down again: Bidding-down attacks and mitigations in 5g and 4g. WiSec ’23, 2023

    work page 2023

  4. [4]

    Imsi-catch me if you can: Imsi-catcher-catchers

    Adrian Dabrowski, Nicola Pianta, Thomas Klepp, Martin Mulazzani, and Edgar Weippl. Imsi-catch me if you can: Imsi-catcher-catchers. ACSAC ’14, 2014

    work page 2014

  5. [5]

    Imsi catchers: hacking mobile communications

    Andy Lilly. Imsi catchers: hacking mobile communications. Network Security, 2017

    work page 2017

  6. [6]

    Imsi catchers in the wild: A real world 4g/5g assessment

    Ivan Palam `a, Francesco Gringoli, Giuseppe Bianchi, and Nicola Blefari- Melazzi. Imsi catchers in the wild: A real world 4g/5g assessment. Computer Networks, 2021

    work page 2021

  7. [7]

    New vulnerabilities in 4g and 5g cellular access network protocols: exposing device capabilities

    Altaf Shaik, Ravishankar Borgaonkar, Shinjo Park, and Jean-Pierre Seifert. New vulnerabilities in 4g and 5g cellular access network protocols: exposing device capabilities. WiSec ’19, 2019

    work page 2019

  8. [8]

    Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations

    Ankush Singla, Rouzbeh Behnia, Syed Rafiul Hussain, Attila Yavuz, and Elisa Bertino. Look before you leap: Secure connection bootstrapping for 5g networks to defend against fake base-stations. ASIA CCS ’21, 2021

    work page 2021

Show all 38 references
  1. [9]

    https://open5gs.org

    Open5GS. https://open5gs.org

  2. [10]

    Software Radio Systems

    SRS. Software Radio Systems. Open source SDR 4G/5G software suite. https://github.com/srsran/srsRAN, 2020

    2020

  3. [11]

    Flexible RAN Intelligent Con- troller (FlexRIC)

    OpenAirInterface Software Alliance. Flexible RAN Intelligent Con- troller (FlexRIC). https://github.com/lgs96/flexric, 2021

    2021

  4. [12]

    Logic gone astray: A security analysis framework for the control plane protocols of 5g basebands

    Kai Tu, Abdullah Al Ishtiaq, Syed Md Mukit Rashid, Yilu Dong, Weixuan Wang, Tianwei Wu, and Syed Rafiul Hussain. Logic gone astray: A security analysis framework for the control plane protocols of 5g basebands. In 33rd USENIX Security Symposium , 2024

    2024

  5. [13]

    Sok: Evaluating 5g protocols against legacy and emerging privacy and security attacks, 2024

    Stavros Eleftherakis, Domenico Giustiniano, and Nicolas Kourtellis. Sok: Evaluating 5g protocols against legacy and emerging privacy and security attacks, 2024

    2024

  6. [14]

    A systematic analysis method for 5g non-access stratum signalling security

    Xinxin Hu, Caixia Liu, Shuxin Liu, Wei You, Yingle Li, and Yu Zhao. A systematic analysis method for 5g non-access stratum signalling security. IEEE Access, 2019

    2019

  7. [15]

    Privacy attacks to the 4g and 5g cellular paging protocols using side channel information

    Syed Rafiul Hussain, Mitziu Echeverria, Omar Chowdhury, Ninghui Li, and Elisa Bertino. Privacy attacks to the 4g and 5g cellular paging protocols using side channel information. Network and distributed systems security (NDSS) , 2019

    2019

  8. [16]

    LTrack: Stealthy tracking of mobile phones in LTE

    Martin Kotuliak, Simon Erni, Patrick Leu, Marc R ¨oschlin, and Srdjan Capkun. LTrack: Stealthy tracking of mobile phones in LTE. In 31st USENIX Security Symposium , 2022

    2022

  9. [17]

    Security Architecture and Procedures for 5G System

    3rd Generation Partnership Project (3GPP). Security Architecture and Procedures for 5G System. Technical Specification TS 33.501

  10. [18]

    Study on 5G Security Enhancement against False Base Stations

    3rd Generation Partnership Project (3GPP). Study on 5G Security Enhancement against False Base Stations. Technical Report TR 33.809

  11. [19]

    De- mystifying privacy in 5g stand alone networks

    Stavros Eleftherakis, Timothy Otim, Giuseppe Santaromita, Almu- dena D ´ıaz Zayas, Domenico Giustiniano, and Nicolas Kourtellis. De- mystifying privacy in 5g stand alone networks. ACM MobiCom ’24, 2024

    2024

  12. [20]

    5greasoner: A property-directed security and privacy analysis framework for 5g cellular network protocol

    Syed Rafiul Hussain, Mitziu Echeverria, Imtiaz Karim, Omar Chowd- hury, and Elisa Bertino. 5greasoner: A property-directed security and privacy analysis framework for 5g cellular network protocol. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications ...

    2019

  13. [21]

    5g-spector: An o-ran compliant layer-3 cellular attack detection service

    Haohuang Wen, Phillip Porras, Vinod Yegneswaran, Ashish Gehani, and Zhiqiang Lin. 5g-spector: An o-ran compliant layer-3 cellular attack detection service. In Proceedings of the 31st Annual Network and Distributed System Security Symposium (NDSS’24) , 2024

    2024

  14. [22]

    Ai-driven network intrusion detection and resource allocation in real-world o-ran 5g networks

    Theodoros Tsourdinis, Nikos Makris, Thanasis Korakis, and Serge Fdida. Ai-driven network intrusion detection and resource allocation in real-world o-ran 5g networks. ACM MobiCom ’24, 2024

    2024

  15. [23]

    Developing xapps for rogue base station detection in sdr-enabled o-ran

    Jun-Hong Huang, Shin-Ming Cheng, Rafael Kaliski, and Cheng-Feng Hung. Developing xapps for rogue base station detection in sdr-enabled o-ran. In IEEE Conference on Computer Communications Workshops , 2023

    2023

  16. [24]

    Amachaghi, Sulyman Abdulkareem, Sotiris Chatzimiltis, Mohammad Shojafar, and Chuan H

    Emmanuel N. Amachaghi, Sulyman Abdulkareem, Sotiris Chatzimiltis, Mohammad Shojafar, and Chuan H. Foh. An efficient intrusion detection solution for near-real-time open-ran. In 2024 IEEE Symposium on Computers and Communications (ISCC) , 2024

    2024

  17. [25]

    Packet continuity ddos attack detection for open fronthaul in oran system

    Jung-Erh Chang, Yi-Chen Chiu, Yi-Wei Ma, Zhi-Xiang Li, and Cheng- Long Shao. Packet continuity ddos attack detection for open fronthaul in oran system. In 2024 IEEE Network Operations and Management Symposium, 2024

    2024

  18. [26]

    Det-ran: Data-driven cross-layer real-time attack detection in 5g open rans

    Alessio Scalingi, Salvatore D’Oro, Francesco Restuccia, Tommaso Melodia, and Domenico Giustiniano. Det-ran: Data-driven cross-layer real-time attack detection in 5g open rans. In IEEE INFOCOM 2024 , 2024

    2024

  19. [27]

    Open ran for detection of a jamming attack in a 5g network

    Pawel Kryszkiewicz and Marcin Hoffmann. Open ran for detection of a jamming attack in a 5g network. In 2023 IEEE 97th Vehicular Technology Conference, 2023

    2023

  20. [28]

    Cross-domain ai for early attack detection and de- fense against malicious flows in o-ran

    Bruno Missi Xavier, Merim Dzaferagic, Irene Vil `a, Magnos Martinello, and Marco Ruffini. Cross-domain ai for early attack detection and de- fense against malicious flows in o-ran. In ICC 2024 - IEEE International Conference on Communications , 2024

    2024

  21. [29]

    6g-xsec: Explainable edge security for emerging openran architectures

    Haohuang Wen, Prakhar Sharma, Vinod Yegneswaran, Phillip Porras, Ashish Gehani, and Zhiqiang Lin. 6g-xsec: Explainable edge security for emerging openran architectures. HotNets ’24, 2024

    2024

  22. [30]

    NR; Radio Resource Control (RRC); Protocol Specification

    3rd Generation Partnership Project (3GPP). NR; Radio Resource Control (RRC); Protocol Specification. Technical Specification TS 38.331

  23. [31]

    NG-RAN; Architecture Description

    3rd Generation Partnership Project (3GPP). NG-RAN; Architecture Description. Technical Specification TS 38.401

  24. [32]

    E2 Application Protocol (E2AP)

    O-RAN Work Group 3 (WG3). E2 Application Protocol (E2AP). Technical Specification O-RAN.WG3.TS.E2AP-R004-v07.00

  25. [33]

    Near-Real-Time RAN Intelli- gent Controller (RIC) Architecture

    O-RAN Work Group 3 (WG3). Near-Real-Time RAN Intelli- gent Controller (RIC) Architecture. Technical Specification O- RAN.WG3.TS.RICARCH-R004-v07.00

  26. [34]

    Management and Orchestra- tion; 5G Performance Measurements

    3rd Generation Partnership Project (3GPP). Management and Orchestra- tion; 5G Performance Measurements. Technical Specification TS 28.552

  27. [35]

    Autoencoders

    Dor Bank, Noam Koenigstein, and Raja Giryes. Autoencoders. Springer International Publishing, 2023

    2023

  28. [36]

    https://docs.srsran.com/projects/project/en/latest/tutorials/source/ handover/source/index.html, 2020

    SRS. https://docs.srsran.com/projects/project/en/latest/tutorials/source/ handover/source/index.html, 2020

    2020

  29. [37]

    Network signal guru

    Qtrun Technologies. Network signal guru. https://www.qtrun.com/eng/ nsg/, 2025

    2025

  30. [38]

    QxDM Professional Qualcomm eXtensible Diagnostic Monitor., 2022

    Qualcomm. QxDM Professional Qualcomm eXtensible Diagnostic Monitor., 2022

    2022

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.