PaperlayerView exact revision on arXiv

Source-linked AI summary

Explainability Boosted Anomaly Detection Framework for O-RAN based NextG Networks

Nurullah Aksu, Ali Fuat Sahin, Semiha Tedik Başaran

arXiv:2608.14826v1eess.SPcs.CRcs.LG

TL;DR

NextG cellular networks remain exposed to evolving attacks, creating a need for effective and interpretable anomaly detection in O-RAN environments. This paper develops an explainability-boosted AI/ML framework and finds that post-hoc feature selection reduces dataset complexity by approximately 80% without compromising performance.

  • Problem

    Evolving attacks and increasingly complex cellular architectures sustain the need for effective anomaly detection in next-generation networks.

  • Method

    The framework combines realistic benign and malicious O-RAN traffic, near-RT RIC monitoring, multiple AI/ML models, and post-hoc explainability to identify influential KPMs.

  • Results

    Approximately 80% dataset complexity reduction is achieved without compromising performance, while RF demonstrates superior overall performance among tested models.

  • Takeaways & Limitations

    The framework identifies critical KPMs and attack characteristics, supporting computationally efficient and explainable anomaly detection for NextG O-RAN security.

Abstract

from arXiv · show

The wireless networks have historically faced significant security vulnerabilities, necessitating advanced anomaly detection mechanisms, especially as networks evolve towards 6G and beyond. This study introduces an advanced anomaly detection framework that leverages explainable artificial intelligence to enhance the security of next-generation (NextG) cellular networks. By implementing and evaluating a variety of artificial intelligence models, the framework demonstrates high accuracy and efficient runtime performance in identifying malicious traffic within a realistic Open Radio Access Network (O-RAN) testbed. A key innovation of this work is the integration of post-hoc explainability methods to identify the most critical key performance metrics (KPMs), which enables a significant 80% reduction in dataset complexity without compromising detection accuracy. Additionally, explainability analyses identify several critical attack traffic characteristics, such as protocol type, bandwidth, interval, and duration, to prevent upcoming network attacks. The resulting framework effectively balances computational efficiency, accuracy, and explainability, underscoring its practical applicability for enhancing security in next-generation cellular networks.

I. INTRODUCTION

The introduction frames persistent and evolving cellular-network security threats, highlights O-RAN’s flexible architecture, and presents an explainability-boosted near-RT RIC anomaly-detection framework for NextG networks.

  • Motivation: Evolving attack methods, user growth, and architectural complexity intensify longstanding security challenges in cellular communication systems.NextG networks respond with stronger, standardized security mechanisms, but security remains critically important.
  • O-RAN Background: O-RAN addresses integration challenges through a flexible, disaggregated, and vendor-agnostic architecture that eliminates vendor lock-in and enables distributed contributions.The passage contrasts O-RAN with conventional cellular infrastructures and identifies its key architectural benefits.
  • Related Work: Prior O-RAN research developed threshold-based, machine-learning, and autoencoder-based xApps for anomaly detection, mitigation, and signalling storm attacks.These studies leverage O-RAN flexibility to support anomaly detection and mitigation applications.
  • Contributions: The study proposes a near-RT RIC anomaly-detection framework using explainability-boosted AI/ML, realistic benign and malicious traffic, and a monitoring xApp for detailed 3GPP radio-protocol measurements.Multiple algorithms are trained and evaluated on the constructed dataset, followed by statistical-based and post-hoc explainability methods.

II. SYSTEM MODEL

The system model establishes a real-time NextG anomaly-detection testbed using open-source 5G infrastructure, near-RT RIC functionality, traffic generators, and monitoring. Its architecture includes a 5G core, one gNB, three UEs, and separate legitimate and malicious traffic roles.

  • Testbed Components: The testbed combines an open-source real-time 5G system, near-RT RIC, hping, iperf3, and a monitoring xApp to generate traffic and collect KPMs.The traffic includes benign and malicious flows, while the xApp collects key performance metrics from the near-RT RIC platform.
  • Network Architecture: The architecture comprises a 5G core network, one gNB, and three registered UEs, with two UEs generating legitimate traffic and one targeting a legitimate user maliciously.Authentication occurs through the core network, and the malicious UE creates the attack scenario.
  • Implementation Configuration: The communication system uses OpenAirInterface with FlexRIC and a monolithic 5G base station, configured in band n78 at 3.6 GHz with 106 PRBs and 20 MHz bandwidth.The subcarrier spacing is 30 kHz, and each network element uses a USRP B200mini software-defined-radio frontend.

A. OpenAirInterface & FlexRIC

This section presents OAI and FlexRIC as open-source platforms supporting vendor-independent O-RAN innovation and near-real-time network control. FlexRIC is deployed to monitor user metrics collected by the base station.

  • OpenAirInterface: O-RAN decouples network development from specific vendors, while OAI supports critical end-to-end 5G functionalities as a prominent open-source platform.OAI is continuously improved through research projects to satisfy industry standards.
  • FlexRIC: FlexRIC provides a near-RT RIC solution that integrates custom logic into 5G networks without significant structural modifications.Its flexible architecture supports xApps for analyzing or manipulating network behavior in near-RT.
  • FlexRIC: FlexRIC is deployed in this study to monitor user metrics collected by the base station.The platform enables new control or analytics functions to be introduced swiftly.

III. DATA COLLECTION PROCESS

The data collection process uses ETSI KPM guidance within FlexRIC and combines benign application traffic with protocol-based signalling floods on a physical testbed. The resulting dataset contains 103 traces, approximately 10 hours of measurements, and 70 features per sample.

  • KPM selection: ETSI Technical Specification 128.552 guides KPM selection in FlexRIC, supplemented by additional metrics covering multiple protocol layers and attack archetypes.Standardized metrics are marked with a star, while additional metrics were introduced to enhance AI/ML model performance.
  • Benign traffic: Benign traffic connects transmitting and receiving UEs across five patterns: Web Browsing, Multimedia Streaming, File Transfer, Remote Access, and Instant Messaging.These patterns emulate common transmission protocols in diverse applications.
  • Malicious traffic: Malicious traffic uses UDP, TCP, and ICMP to generate SYN, UDP, TCP, and ICMP signalling flood attacks with randomly selected transmission rates.Varying intervals add unpredictability intended to emulate real-life attack patterns and operational uncertainty.
  • Dataset composition: 103 traces were collected over several weeks, representing approximately 10 hours of real-world measurements on a physical testbed.Each sample includes 70 features, including 69 KPMs corresponding to three UEs.

IV. METHODOLOGY

The methodology presents a comprehensive anomaly-detection framework designed to handle various data types and incorporate distinctive explainability approaches.

  • The section discusses the methodology of the proposed anomaly-detection framework.
  • The framework is designed to support anomaly detection with various data types.
  • The methodology incorporates distinctive explainability approaches.

A. Exponentially Weighted Moving Average

EWMA is introduced as an adaptive threshold-based statistical algorithm that can identify significant features before AI/ML training, avoiding the computational expense of post-hoc explainability. It detects anomalies using dynamically updated statistics and bounds derived from prior observations.

  • Method rationale: EWMA provides a statistical alternative for identifying significant features before AI/ML training, whose computationally expensive training is required by post-hoc methods.The method is presented to address the computational cost associated with training AI/ML models for post-hoc explainability.
  • Dynamic statistics: The method updates each time instance’s mean using a weighted average of the current observation and previous observations.The mean changes over time according to the hyperparameter αµ.
  • Adaptive thresholds: EWMA calculates time-varying upper and lower bounds using multiplier hyperparameters kU and kL.The bounds define the dynamic range used for anomaly detection.
  • Dynamic statistics: The standard deviation is updated from the absolute deviation between the current observation and the calculated mean, controlled by ασ.The deviation at time t is defined as dt = |xi_t − µt|.
  • Anomaly decision: An observation is classified as anomalous when it falls outside the dynamic bounds; At = 1 denotes an attack and At = 0 denotes normal behaviour.The anomaly indicator has binary values and is triggered when xi_t exceeds Ut or falls below Lt.

B. Artificial Intelligence & Machine Learning Methods

The study selects AI/ML models to examine the trade-off between predictive performance, computational cost, speed, accuracy, and efficiency across distinctive data types.

  • Model Selection: ML methods balance speed, accuracy, and computational efficiency against purely statistical approaches and more complex AI techniques.More complex AI techniques may require extensive tuning and higher resource overhead.
  • Model Selection: AI techniques can provide more advanced prediction performance, but at higher computational cost.
  • Model Selection: AI/ML models were chosen to demonstrate the trade-off between statistical and more complex AI approaches while covering distinctive data types.

C. Post-Hoc Methods

Post-hoc explainability methods estimate the most significant KPMs for anomaly detection by interpreting already-trained models without modifying their structure or training process.

  • Method purpose: Post-hoc methods estimate the most significant KPMs for detecting anomalies.They are applied after a model has already been trained.
  • Method purpose: These methods help explain the reasoning behind a model’s predictions.They are explainability methods applied after training.
  • Method characteristics: Post-hoc methods analyze black-box models without altering the original model structure or training process.They examine the behavior of trained models.

V. RESULTS

The results show that RF provides the strongest overall anomaly-detection performance, while DT offers the lowest inference latency. Explainability identifies uplink activity and attack-pattern features, enabling reduced-feature retraining without sacrificing strong performance.

  • Experimental setup: An 80/20 split produced 8000 training and 2000 test samples, while IF used the entire dataset to emulate unsupervised learning.Ten fixed-seed training runs per model were conducted for robustness and reproducibility.
  • Detection performance: RF attained the highest training and test accuracy, followed by DT; KNN showed the only overfitting tendency, while other models generalized well.IF was the sole exception to high training accuracy, consistent with its unsupervised anomaly-detection design.
  • Computational efficiency: DT achieved the lowest inference latency, KNN the best runtime from minimal training cost, and LSTM the highest computational cost from its many trainable parameters.These results distinguish training-time efficiency from inference latency in the evaluated setting.
  • Global explainability: LIME and SHAP both ranked A_DRB.UEThpUl and A_DRB.PdcpSduVolumeUL as the two most influential features, reflecting uplink data activity.LIME additionally highlighted A_DRB.UEBufferSizeUL, indicative of flooding, whereas SHAP identified A_RRU.PrbTotDL.
  • Significant-feature retraining: Retraining on 12 significant features preserved strong RF and DT accuracy, improved the remaining models, eliminated KNN overfitting, and reduced runtime for RF, DT, and LSTM.The reduced-feature phase retained 12 features because the attacker cannot be known a priori, with hyperparameters kept unchanged.
  • Sequence-based explainability: EWMA reliably detected anomalies in A_DRB.UEThpUl under randomized bandwidths, attack intervals, and durations, while additional metrics distinguished attack protocol types.A_DRB.PdcpSduVolumeUL was omitted from reporting because it exhibited nearly identical temporal patterns to A_DRB.UEThpUl.

VI. CONCLUSION

The study proposes an O-RAN-based anomaly detection framework using AI/ML models and realistic benign and malicious traffic scenarios. Its dataset uses real-time O-RAN standardized performance metrics, while future work targets unsupervised and zero-day detection and real-time deployment analysis.

  • The proposed framework uses AI/ML models with dedicated traffic-generation tools to simulate realistic benign and malicious traffic scenarios.
  • The dataset comprises real-time O-RAN standardized performance metrics with randomized patterns, unlike legacy NSL-KDD and 5G-NIDD datasets.
  • RF demonstrates superior performance among the tested models.
  • Future work will explore unsupervised anomaly detection, zero-day attack detection, and O-RAN-based latency and overhead analysis for real-time deployment.
Loading 2608.14826v1…