Source-linked AI summary
Signaling Storm Detection in IIoT Network based on the Open RAN Architecture
Marcin Hoffmann, Pawel Kryszkiewicz
TL;DR
Low-cost, low-complexity IIoT devices can be compromised to launch signaling storm attacks that consume control-plane resources. The paper proposes an O-RAN xApp that monitors early registration messages and uses long-term network statistics to detect abnormal activity. In simulations, γ = 6.5 gives a 1.5% false-alarm probability and a 92% SSA detection probability.
Problem
Compromised IIoT devices can flood the control plane with invalid or repeated registration requests, consuming Core Network resources during authorization.
Source: §I · p. 1Method
An O-RAN xApp intercepts early registration control-plane messages and uses long-term per-TA network statistics to detect abnormal activity.
Source: §I · p. 1, §II · pp. 1–2Results
At γ = 6.5, the false-alarm probability is 1.5% and the SSA detection probability is 92%.
Source: §III · p. 2Takeaways & Limitations
O-RAN enables SSA detection early in adversarial registration, and threshold setting can offer high detection probability with few false alarms.
Source: §IV · p. 2
Abstract
from arXiv · showhide
The Industrial Internet of Things devices due to their low cost and complexity are exposed to being hacked and utilized to attack the network infrastructure causing a so-called Signaling Storm. In this paper, we propose to utilize the Open Radio Access Network (O-RAN) architecture, to monitor the control plane messages in order to detect the activity of adversaries at its early stage.
I. Introduction
The paper frames signaling storm attacks as abuse of control-plane registration mechanisms by potentially compromised IIoT devices, and proposes an O-RAN xApp to detect abnormal activity early.
I. Introduction
- Low-cost, low-complexity IIoT devices may be hacked to flood the control plane with invalid or repeated registration requests.Even rejected requests consume Core Network resources during authorization.Source: §I · p. 1
- O-RAN interfaces allow interaction with the RAN and interception of protocol messages, unlike the limited configurability described for state-of-the-art mobile networks.The O-RAN ALLIANCE identified SSA detection as a problem for a dedicated xApp.Source: §I · p. 1
- The proposed xApp uses O-RAN interfaces to intercept control-plane messages and learn long-term network statistics for detecting abnormal IIoT activity at registration start.Source: §I · p. 1
II. Signaling Storm Detection in O-RAN
The detection xApp uses early registration messages and timing advance to build long-term per-TA profiles, then compares current registration counts with those profiles to detect anomalies.
II. Signaling Storm Detection in O-RAN
- The xApp receives a copy of Msg2, whose Timing Advance (TA) can help filter adversarial devices even when their device identifier changes between registration attempts.IIoT devices are usually stationary, so their TA is constant and proportional to distance from the gNB.Source: §II · p. 1
- KPI Profiles track the mean and standard deviation of RRC Setup Requests associated with each observed TA over consecutive time intervals.The intervals may be five minutes; the profile stores long-term statistics indexed by TA and time of day.Source: §II · p. 1, Figure 2 · p. 2
- The xApp compares the observed RSR count for a TA with its profile and detects an SSA when the anomaly value exceeds threshold γ.Based on the result, it indicates whether the gNB should accept or reject the request, or may send a general policy such as rejecting all requests at TA=77.Source: §II · p. 2
III. Simulation Results
Computer simulations evaluate how threshold γ trades off SSA detection against false alarms, with the reported probabilities varying by threshold.
III. Simulation Results
- The 20-day simulation models one 2-km-radius cell with 100 legitimate IIoT devices and 5 adversaries, using KPI profiles computed without adversaries.Each adversary starts attacks at an exponential rate of 3 per day; each attack sends 100 consecutive RSRs within 5 seconds.Source: §III · p. 2
- Legitimate devices send RSRs at a mean rate of 5 per hour, varying by 35% around noon and midnight to model daytime change.Source: §III · p. 2
- At γ = 6.5, the false-alarm probability is 1.5% and the SSA detection probability is 92%.The authors report that setting γ lets operators balance the probabilities according to network requirements.Source: Figure 3 · p. 2, §III · p. 2
IV. Conclusion
The authors conclude that O-RAN enables early SSA detection and that threshold selection can provide high detection probability with few false alarms.
IV. Conclusion
- O-RAN enables SSA detection early in adversarial registration, while threshold setting can balance high detection probability against a few false alarms.Source: §IV · p. 2