pith. sign in

arxiv: 2606.22450 · v1 · pith:NWQBQFIHnew · submitted 2026-06-21 · 💻 cs.CR

Cross-Layer Intrusion Detection in 5G O-RAN: Gains and Limits of Fusing Radio Telemetry with Network Flow Records

Hamed Fard , Ilya Komarov , Gerhard Wunder This is my paper

Pith reviewed 2026-06-26 10:18 UTC · model grok-4.3

classification 💻 cs.CR
keywords 5G O-RANintrusion detectioncross-layer analysisradio telemetrynetwork flowsmachine learning modelsDoS attacksROC-AUC evaluation
0
0 comments X

The pith

Fusing radio telemetry with network flow records improves intrusion detection in 5G O-RAN only for GRU and Transformer models at a one-percent false-positive rate.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper evaluates whether combining DU radio telemetry and CU network flow records improves intrusion detection over using either modality alone. Experiments cover seven architectures on a live 5G O-RAN dataset with run-disjoint splits. Radio features alone match or exceed network flows across all models. Fusion produces selective ROC-AUC gains but at the one-percent false-positive point it raises detection rate solely for GRU and Transformer while lowering it for the other five. The improvement appears only when both single modalities score below 0.75 detection rate, and DoS-benign confusion stays high at 27-46 percent in every configuration.

Core claim

Fusing radio telemetry and network flow records yields selective ROC-AUC gains but at a one-percent false-positive operating point improves detection rate only for GRU and Transformer, reducing it for the other five models. The benefit is confined to architectures where both single-modality detection rates fall below 0.75. A DoS-to-Benign confusion of 27 to 46 percent persists across all 42 tested configurations of architecture, modality, and window duration.

What carries the argument

Cross-layer fusion of radio telemetry from the distributed unit and network flow records from the central unit, tested as inputs to seven different detection architectures.

If this is right

  • Radio telemetry alone suffices or outperforms network flows for intrusion detection in most cases.
  • Fusion provides benefit only when both individual data sources yield detection rates below 0.75.
  • High DoS-to-benign confusion across all setups indicates the windowed statistical features limit performance rather than model choice.
  • Run-disjoint data splits ensure no leakage between training and test runs.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Alternative time-series representations or per-packet features could lower the observed DoS confusion without requiring new models.
  • Deployments might prioritize collecting radio telemetry since it matches or beats the other modality.
  • Similar cross-layer tests on additional attack types could reveal whether the selective benefit pattern holds more broadly.
  • Online detection without fixed windows might alter the relative value of fusion.

Load-bearing premise

The selected window durations and statistical aggregation on the live 5G O-RAN dataset are sufficient to capture attack signatures, especially for DoS attacks.

What would settle it

Replacing the statistical aggregation with raw packet or sample-level features and observing DoS detection rates consistently above 80 percent across multiple architectures would indicate the limitation is not in the aggregation method.

Figures

Figures reproduced from arXiv: 2606.22450 by Gerhard Wunder, Hamed Fard, Ilya Komarov.

Figure 1
Figure 1. Figure 1: Time-to-detection CDFs at 1 % FPR (benign-calibrated threshold, flow-onset, [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Per-class analysis of XGBoost fusion mean (W=10, 10 run-disjoint seeds aggregated). (a) Row-normalised confusion matrix. The red border highlights the dominant error: 37.3% of DoS windows are classified as Benign. (b) Per-class F1 by feature set. Per-class F1 values are computed from predictions pooled across all 10 seeds to stabilize rare-class cell counts in the confusion matrix. The F1-macro in Table II… view at source ↗
Figure 3
Figure 3. Figure 3: Paired within-seed differences (Wilcoxon signed-rank test, two-sided, 10 run-disjoint seeds). Each dot is one seed’s difference; circles (blue) show [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
read the original abstract

Open RAN disaggregation enables joint analysis of DU radio telemetry and CU-side network-flow records, motivating cross-layer intrusion detection. We evaluate whether fusing these two modalities improves over each individually across seven architectures, using run-disjoint splits over ten seeds on a live 5G O-RAN dataset. Radio features match or outperform network flows on ROC-AUC and run-level detection rate across all architectures. Fusion yields selective ROC-AUC gains but at a one-percent false-positive operating point improves detection rate only for GRU and Transformer, reducing it for the other five models. The benefit is confined to architectures where both single-modality detection rates fall below 0.75. A DoS-to-Benign confusion of 27 to 46 percent persists across all 42 tested configurations of architecture, modality, and window duration, pointing to a limitation in the tested windowed statistical aggregation rather than in model capacity. Code is publicly available.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 1 minor

Summary. The manuscript evaluates whether fusing DU radio telemetry with CU network-flow records improves intrusion detection over single modalities in 5G O-RAN. Across seven architectures, run-disjoint splits, and ten seeds on a live dataset, radio features match or outperform network flows; fusion yields selective ROC-AUC gains but improves detection rate at 1% FPR only for GRU and Transformer (and only when both single-modality rates are below 0.75). A 27-46% DoS-to-Benign confusion persists across all 42 architecture-modality-window configurations, which the authors attribute to a limitation in the tested windowed statistical aggregation rather than model capacity. Public code is provided.

Significance. The multi-architecture, multi-seed comparison with explicit run-disjoint splits supplies a reproducible empirical baseline for cross-layer O-RAN IDS. If the attribution of persistent confusion to the aggregation method is substantiated, the result would usefully bound expectations for windowed statistical fusion in this setting and motivate alternative feature representations.

major comments (2)
  1. [Abstract] Abstract: the inference that the invariant 27-46% DoS-to-Benign confusion across 42 configurations 'pointing to a limitation in the tested windowed statistical aggregation rather than in model capacity' is not demonstrated, because no contrast experiment is reported that applies non-windowed or non-statistical feature extraction to the same live 5G O-RAN traces. Invariance across architectures rules out model capacity but leaves open whether the chosen aggregation itself encodes the attack signatures.
  2. [Experimental setup] Experimental setup (implied by the description of window durations and aggregation): the claim that the selected windows and statistical aggregation are sufficient to capture DoS signatures rests on the assumption that run-disjoint splits fully eliminate leakage and that the aggregation method is not the source of the observed confusion; without a direct comparison to raw or differently extracted features, this remains an untested precondition for the central interpretation.
minor comments (1)
  1. Clarify in the main text (or appendix) the precise list of statistical aggregates computed per window and the exact criteria used to label runs as attack or benign, even though code is public.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments, which correctly identify that our interpretation of the persistent DoS-to-Benign confusion requires qualification. We address each major comment below and will revise the manuscript to ensure claims are supported by the reported experiments.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the inference that the invariant 27-46% DoS-to-Benign confusion across 42 configurations 'pointing to a limitation in the tested windowed statistical aggregation rather than in model capacity' is not demonstrated, because no contrast experiment is reported that applies non-windowed or non-statistical feature extraction to the same live 5G O-RAN traces. Invariance across architectures rules out model capacity but leaves open whether the chosen aggregation itself encodes the attack signatures.

    Authors: We agree that invariance across the seven architectures rules out model capacity as the cause but does not constitute a controlled demonstration that the windowed statistical aggregation is responsible. The manuscript reports no experiments with raw packet traces, per-packet features, or non-statistical extraction methods on the same dataset. We will revise the abstract to state only that the confusion persists across all 42 architecture-modality-window configurations and therefore lies outside differences in model capacity, while noting that alternative feature representations remain an open direction for future work. revision: yes

  2. Referee: [Experimental setup] Experimental setup (implied by the description of window durations and aggregation): the claim that the selected windows and statistical aggregation are sufficient to capture DoS signatures rests on the assumption that run-disjoint splits fully eliminate leakage and that the aggregation method is not the source of the observed confusion; without a direct comparison to raw or differently extracted features, this remains an untested precondition for the central interpretation.

    Authors: The run-disjoint splits are described in Section 4.2 and are intended to prevent temporal leakage; however, we acknowledge that sufficiency of the chosen aggregation for DoS signatures is an assumption not tested against raw or alternative feature sets. The primary contribution is the modality and fusion comparison; the confusion observation is secondary. We will revise the experimental setup and discussion sections to present the aggregation choice as a design decision whose limitations are evidenced by the cross-configuration results, without asserting that it is definitively the source of the confusion. revision: yes

Circularity Check

0 steps flagged

No circularity: purely empirical evaluation with no derivation chain

full rationale

The manuscript is an empirical comparative study reporting ROC-AUC, detection rates, and confusion matrices across 42 configurations of architecture, modality, and window duration on a live 5G O-RAN dataset. No equations, ansatzes, uniqueness theorems, or parameter-fitting steps are present that could reduce to their own inputs. Results are direct measurements; the claim that persistent DoS-to-Benign confusion indicates a limit in windowed aggregation is an interpretation of the data, not a self-referential derivation. No self-citations are load-bearing. The work is self-contained against external benchmarks.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 0 invented entities

Review based on abstract only; full details on modeling assumptions unavailable.

axioms (2)
  • domain assumption Run-disjoint splits ensure temporal independence between training and test data
    Invoked to justify the evaluation protocol.
  • domain assumption Windowed statistical features adequately represent attack behaviors in the 5G traffic
    Underlies the feature extraction used for all modalities and models.

pith-pipeline@v0.9.1-grok · 5701 in / 1338 out tokens · 51572 ms · 2026-06-26T10:18:39.793171+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

20 extracted references · 1 linked inside Pith

  1. [1]

    Un- derstanding O-RAN: Architecture, interfaces, algorithms, security, and research challenges,

    M. Polese, L. Bonati, S. D’Oro, S. Basagni, and T. Melodia, “Un- derstanding O-RAN: Architecture, interfaces, algorithms, security, and research challenges,”IEEE Commun. Surveys Tuts., vol. 25, no. 2, pp. 1376–1411, 2nd Quart. 2023

    2023

  2. [2]

    End-to-end O-RAN security architec- ture, threat surface, coverage, and the case of the open fronthaul,

    A. S. Abdalla and V . Marojevic, “End-to-end O-RAN security architec- ture, threat surface, coverage, and the case of the open fronthaul,”IEEE Commun. Standards Mag., vol. 8, no. 1, pp. 36–43, Mar. 2024

    2024

  3. [3]

    T. S. Parlanti and C. A. Catania. (2025) Temporal analysis framework for intrusion detection systems: A novel taxonomy for time-aware cybersecurity. ArXiv:2511.03799. [Online]. Available: https://arxiv.org/abs/2511.03799

    arXiv 2025

  4. [4]

    Descriptor: 5G Open Radio Access Network multi-modal intrusion detection dataset (NetsLab-5GORAN-IDD),

    F. A. Zadeh, A. Civciss, V . Ravihansa, C. Sandeepa, and M. Liyanage, “Descriptor: 5G Open Radio Access Network multi-modal intrusion detection dataset (NetsLab-5GORAN-IDD),”IEEE Data Descriptions, 2025

    2025

  5. [5]

    A survey for intrusion detection systems in open RAN,

    E. N. Amachaghi, M. Shojafar, C. H. Foh, and K. Moessner, “A survey for intrusion detection systems in open RAN,”IEEE Access, vol. 12, pp. 88 146–88 173, Jun. 2024

    2024

  6. [6]

    5G- Spector: An O-RAN compliant layer-3 cellular attack detection service,

    H. Wen, P. A. Porras, V . Yegneswaran, A. Gehani, and Z. Lin, “5G- Spector: An O-RAN compliant layer-3 cellular attack detection service,” inProc. Netw. Distrib. Syst. Secur. Symp. (NDSS), San Diego, CA, USA, Feb. 2024

    2024

  7. [7]

    Det-RAN: Data-driven cross-layer real-time attack detection in 5G open RANs,

    A. Scalingi, S. D’Oro, F. Restuccia, T. Melodia, and D. Giustiniano, “Det-RAN: Data-driven cross-layer real-time attack detection in 5G open RANs,” inProc. IEEE INFOCOM 2024 - IEEE Conf. Comput. Commun., Vancouver, BC, Canada, May 2024, pp. 41–50

    2024

  8. [8]

    AI-driven network intrusion detection and resource allocation in real-world O-RAN 5G networks,

    T. Tsourdinis, N. Makris, T. Korakis, and S. Fdida, “AI-driven network intrusion detection and resource allocation in real-world O-RAN 5G networks,” inProc. 30th Annu. Int. Conf. Mobile Comput. Netw. (Mo- biCom), Washington, DC, USA, Nov. 2024, pp. 1842–1849

    2024

  9. [9]

    Machine learning-based early attack detection using open RAN intelligent controller,

    B. M. Xavier, M. Dzaferagic, D. Collins, G. Comarela, M. Martinello, and M. Ruffini, “Machine learning-based early attack detection using open RAN intelligent controller,” inProc. IEEE Int. Conf. Commun. (ICC), Rome, Italy, May 2023, pp. 1856–1861

    2023

  10. [10]

    Silent signals, loud threats: Using dApps for radio signal intelligence- based intrusion detection in 5G O-RAN,

    A. Civciss, V . Ravihansa, F. A. Zadeh, C. Sandeepa, and M. Liyanage, “Silent signals, loud threats: Using dApps for radio signal intelligence- based intrusion detection in 5G O-RAN,”IEEE Trans. Netw. Service Manag., vol. 21, no. 4, pp. 4119–4134, Aug. 2024

    2024

  11. [11]

    Cross-domain AI for early attack detection and defense against ma- licious flows in O-RAN,

    B. M. Xavier, M. Dzaferagic, I. Vil `a, M. Martinello, and M. Ruffini, “Cross-domain AI for early attack detection and defense against ma- licious flows in O-RAN,” inProc. IEEE Int. Conf. Commun. (ICC), Denver, CO, USA, Jun. 2024, pp. 2384–2389

    2024

  12. [12]

    A multimodal hybrid parallel network intrusion detection model,

    S. Shi, D. Han, and M. Cui, “A multimodal hybrid parallel network intrusion detection model,”Connection Sci., vol. 35, no. 1, p. 2227780, Jun. 2023

    2023

  13. [13]

    A novel multimodal- sequential approach based on multi-view features for network intrusion detection,

    H. He, X. Sun, H. He, G. Zhao, L. He, and J. Ren, “A novel multimodal- sequential approach based on multi-view features for network intrusion detection,”IEEE Access, vol. 7, pp. 183 207–183 221, Dec. 2019

    2019

  14. [14]

    XGBoost: A scalable tree boosting system,

    T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” inProc. 22nd ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining, 2016, pp. 785–794

    2016

  15. [15]

    Learning phrase representations using RNN encoder–decoder for statistical machine translation,

    K. Cho, B. van Merri ¨enboer, C. Gulcehre, D. Bahdanau, F. Bougares, H. Schwenk, and Y . Bengio, “Learning phrase representations using RNN encoder–decoder for statistical machine translation,” inProc. Conf. Empirical Methods Natural Lang. Process. (EMNLP), Doha, Qatar, Oct. 2014, pp. 1724–1734

    2014

  16. [16]

    An empirical evaluation of generic convolutional and recurrent networks for sequence modeling,

    S. Bai, J. Z. Kolter, and V . Koltun, “An empirical evaluation of generic convolutional and recurrent networks for sequence modeling,”arXiv preprint arXiv:1803.01271, 2018

    Pith/arXiv arXiv 2018

  17. [17]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” inProc. Adv. Neural Inf. Process. Syst. (NIPS), vol. 30, 2017, pp. 5998–6008. [Online]. Available: https://papers.nips.cc/paper/ 7181-attention-is-all-you-need

    2017

  18. [18]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778

    2016

  19. [19]

    Optuna: A next-generation hyperparameter optimization framework,

    T. Akiba, S. Sano, T. Yanase, T. Ohta, and M. Koyama, “Optuna: A next-generation hyperparameter optimization framework,” inProc. 25th ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining, 2019, pp. 2623–2631

    2019

  20. [20]

    Individual comparisons by ranking methods,

    F. Wilcoxon, “Individual comparisons by ranking methods,”Biometrics Bulletin, vol. 1, no. 6, pp. 80–83, Dec. 1945

    1945