PaperlayerView exact revision on arXiv

Source-linked AI summary

FlyBlind: Cross-Slice Timeliness Attacks on UAV Situational Awareness over 5G

Wagner Comin Sonaglio, Ágney Lopes Roth Ferraz, André Elias Melo, Guevara Noubir, Lourenço Alves Pereira Júnior

arXiv:2608.27604v1cs.CR

TL;DR

FlyBlind addresses the underexplored risk that an authorized co-tenant can stale a BVLOS UAV’s GCS state without disrupting connectivity. It introduces and tests a cross-slice uplink timeliness attack, finding roughly 12 s telemetry age and tens-of-meters divergence while link indicators remain healthy. The results support destination freshness monitoring and uplink floors in deployments with asymmetric enforcement.

  • Problem

    Destination freshness under an authorized subscriber adversary remains underexplored even though BVLOS operators monitor link latency, availability, and integrity.

  • Method

    FlyBlind sustains authorized uplink demand on a neighboring slice under soft isolation to create GCS-state aging, formalized as a falsifiable false-healthy predicate.

  • Results

    12 s telemetry age and tens-of-meters GCS-position divergence occur while OWD p99 remains in the tens of milliseconds, availability exceeds 99.9%, and GUIDED flight continues without failsafe.

  • Takeaways & Limitations

    Deployments with asymmetric uplink enforcement need destination freshness verification and effective per-S-NSSAI uplink floors in addition to link-health monitoring.

  • Takeaways & Limitations

    The evaluation is bounded to a single reproducible OAI, ORANSlice, and ArduPilot SITL implementation with soft isolation and incomplete or asymmetric uplink enforcement.

Abstract

from arXiv · show

Beyond Visual Line of Sight (BVLOS) Uncrewed Aerial Systems (UAS) operating over 5G Standalone (SA) networks use a shared User Plane for both command-and-control (C2) data and video feedback. Operators assess link quality through latency and availability, relying on soft isolation between network slices. However, the risk that an authorized co-tenant could make the Ground Control Station (GCS) state outdated without disrupting the connection remains underexplored. This work introduces FlyBlind, a timeliness attack in which an authorized co-tenant on a neighboring slice maintains legitimate uplink demand, causing state aging at the GCS without a rogue gNB or direct interference with C2 traffic. Our key insight is that, under soft isolation, sharing idle resources turns authorized competition for grants into state aging that conventional link monitors fail to detect. We formalize this effect, termed Silent State Staleness, as a falsifiable false-healthy predicate. On a dedicated testbed, telemetry age at the GCS saturates at approximately 12 seconds, with discrepancies of tens of meters between the GCS position estimate and ground truth, while the one-way delay (OWD) p99 remains in the tens of milliseconds, availability exceeds 99.9%, and the vehicle keeps operating in GUIDED mode without triggering failsafe mechanisms. These findings indicate that, in deployments with asymmetric uplink enforcement, verifying state freshness at the destination is essential rather than relying solely on link health.

1 Introduction

FlyBlind exposes a timeliness failure in BVLOS UAS over 5G: authorized uplink contention can make GCS state stale while conventional connectivity indicators remain healthy. The paper formalizes and validates this false-healthy condition and evaluates its mitigation cost.

  • Attack and gap: Destination freshness remains underexplored even though operators commonly monitor latency, availability, and integrity for BVLOS links.Silent State Staleness targets the timeliness of remote situational awareness rather than connection availability.
  • Attack and gap: FlyBlind uses legitimate neighbor-slice uplink demand to age UAV state at the GCS without a rogue gNB or direct interference with victim C2 traffic.Soft isolation turns competition for grants and PRBs into telemetry delay while commands remain operational.
  • Evaluation: Telemetry age at the GCS saturates around 12 s while displayed position diverges by tens of meters, despite OWD p99 remaining in the tens of milliseconds and availability above 99.9%.The vehicle continues flying in GUIDED mode without triggering a failsafe.
  • Formalization: The paper formalizes Silent State Staleness as a falsifiable false-healthy predicate separating link KPIs from state freshness at the GCS.The predicate uses Hnet=1, Hveh=1, and FGCS=0.
  • Observability: Freshness-aware observability instruments delivery age and belief-versus-truth because monitored latency, availability, and integrity can remain green while the operational property fails.The contribution addresses the need to measure state at the destination rather than relying only on link health.
  • Mitigation: An uplink floor restores freshness, while ReservationCost and ReservationWaste characterize the cost of stronger isolation.The paper attributes aging through controls that rule out static queues, scheduling caps, and clock offset as dominant causes.

2 Background and Motivation

The background distinguishes soft RAN isolation, uplink scheduling, and destination freshness as interacting parts of the BVLOS risk surface. It motivates AoI and belief-versus-truth monitoring because healthy link metrics may coexist with degraded remote state.

  • RAN slicing: Soft dynamic slicing can lend idle resources across slices, leaving instantaneous radio-resource disputes despite quotas, priorities, and management-plane slice parameters.This work-conserving behavior constitutes incomplete isolation by construction.
  • UL/DL asymmetry: Uplink scheduling derives transmission opportunities from UE Scheduling Requests and Buffer Status Reports, whereas the scheduler assigns downlink resources through PDCCH.This asymmetry lets co-tenant demand delay telemetry opportunities on the uplink.
  • UL/DL asymmetry: Telemetry originates on the vehicle and travels over the uplink, while the downlink carries commands; therefore state freshness depends specifically on the returning uplink path.UAV networks also commonly have more downlink than uplink capacity and traffic.
  • UAS traffic: Video feedback adds a heavier flow to the UAV’s small telemetry and C2 traffic, making scheduler behavior and slice configuration part of the operational risk surface.The video is control-assistance feedback, distinct from mission or payload video.
  • Freshness and AoI: Age of Information measures the time since the timestamp of the newest update delivered to the destination, capturing queue and service delay even when packets continue arriving.A filled uplink queue therefore materializes as increased delivery age at the GCS.
  • Differential observability: Operators can see good link latency, availability, and integrity while GCS state freshness fails, creating a differential-observability gap in remote situational awareness.Prior benign O-RAN experiments also report residual divergence between pilot observations and received telemetry.

3 Threat Model

The threat model places FlyBlind in a 5G SA cell where a legitimate neighbor-slice subscriber sustains uplink demand against a freshness-sensitive UAV link. Success means degrading GCS state freshness while connectivity and flight remain apparently healthy.

  • System model: The system includes a GCS, a UAV UE carrying C2 and video on the User Plane, a shared gNB, and co-tenant UEs on a distinct S-NSSAI.The GCS and UAV share the critical slice while neighbor UEs use another slice in the same cell.
  • Adversary: The adversary controls only authorized neighbor-slice UEs and has no rogue gNB, jamming, MAVLink, RAN, core, or administrative compromise capability.FlyBlind uses normative resource sharing rather than a flaw in 5G architecture.
  • Adversary: The attacker generates high-average-rate authorized uplink traffic, often as periodic microbursts, choosing the number of UEs, burst pattern, and start time.Traffic is sent to an endpoint external to the victim.
  • Objective: Attack success is defined by increased position-telemetry delivery age and GCS-belief divergence from UAV ground truth while connectivity indicators and physical flight remain healthy.The objective is not maximum availability impact.
  • Assumptions: The attack assumes soft isolation without an explicit temporal guarantee for C2, with C2 and video multiplexed on the same uplink and idle resources shareable across slices.Baseline B0 lacks rRMPolicyRatio enforcement; mitigation introduces an uplink floor.
  • Scope: Confidentiality, integrity, network-element compromise, RF attacks, and attacks targeting the victim C2 endpoint are outside the threat model.The paper focuses on temporal degradation through cross-slice uplink scheduling contention.

4 The FlyBlind Attack

FlyBlind exploits legitimate uplink demand on a neighboring slice to age telemetry at the GCS without directly disrupting C2 traffic. The attack converts grant contention and queueing into Silent State Staleness while conventional connectivity indicators remain healthy.

  • Attack mechanism: Authorized co-tenant uplink demand makes the gNB split service opportunities among co-tenant UEs, increasing the victim’s telemetry update wait time.The attacker does not steal an already assigned grant or touch the victim C2 flow.
  • Attack mechanism: Video feedback is the load conditioner that brings the victim UE near the temporal boundary where contention begins aging telemetry.With rvideo = 0, multi-rogue contention barely alters freshness; with video enabled, the same adversary raises AoI to seconds.
  • Freshness measurement: The attack measures per-message delivery age δi for correlated LOCAL_POSITION_NED telemetry using separate monotonic clocks at the UAV and GCS.time_boot_ms identifies corresponding messages, while δi measures delivery age rather than serving as the correlation identifier.
  • False-healthy state: Under attack, delivery age rises from milliseconds to seconds and GCS state divergence increases by orders of magnitude while GUIDED mode, failsafe status, and physical tracking remain near baseline.The PRE/ATTACK/DRAIN pattern shows δi filling during attack and draining after termination while OWD p99 stays in the tens of milliseconds.
  • Causal attribution: The observed causal chain runs from authorized cross-slice grant contention to reduced victim UL service, backlog growth, rising and saturating δi, and drainage after attack cessation.Evaluation attributes the effect to UL grant contention rather than a static internal queue, scheduling cap, or static clock offset.

5 Experimental Setup

The experiments use a reproducible 5G SA testbed with sliced RAN resources, a cyber-physical ArduPilot loop, and separate probe and telemetry paths. Measurements jointly capture freshness, belief divergence, scheduling proxies, connectivity, and vehicle health under controlled video and rogue-UE loads.

  • Platform: The testbed combines OpenAirInterface Core and RAN, ORANSlice scheduling, Kubernetes orchestration, and deterministic OAI rfsim radio emulation.The radio configuration uses band n78 TDD with 106 and 51 PRB and numerology μ = 1.
  • Platform: ArduPilot SITL closes the cyber-physical loop using MAVLink/UDP over the User Plane, including flight modes, failsafes, and physical tracking.The vehicle and GCS use slice B, while rogue UEs use slice A; both slices share the cell, gNB, and UPF.
  • Instrumentation: Figure 5 distinguishes the monitored GCS-to-UAV probe from the UAV-to-GCS telemetry and belief leg, plus video feedback and attack UL paths.The probe measures OWD, IPDV, and availability on the opposite leg, whereas telemetry delivery age measures state freshness.
  • Metrics: The evaluation reports delivery age, belief-versus-truth divergence, tracking metrics, connectivity KPIs, heartbeat and failsafe status, scheduling shares, and offered versus observed UL load.Quantiles are aggregated per run with medians and spread across runs.
  • Metrics: The campaign fixes τfresh = 150 ms, above baseline δ p99 ≈ 56 ms and below the attack regime in seconds, without treating it as a normative DO-377 threshold.Freshness-aware availability is computed over correlated telemetry deliveries and compared with conventional network and vehicle health.
  • Load model: Video load uses rate-matched iperf3 UDP traffic, including 12 Mbps within reported real-time remote-piloting video rates, while rogues generate authorized UL microbursts.Each rogue contributes rrogue = 20 Mbps, so one and four rogues offer 20 Mbps and 80 Mbps respectively.
  • Load model: Table 1 reports UL load and scheduling proxies, distinguishing offered, sender, admitted, and PUSCH quantities from NPRB share.The default max_sched_ues value is approximately four UEs per scheduling opportunity at 106 PRB.

6 Evaluation

FlyBlind produces severe destination-state staleness while conventional connectivity and flight indicators remain apparently healthy. The effect depends on video-conditioned uplink contention, adversarial dose, and available uplink resources.

  • 6.1 False-Healthy Headline: Hnet and Hveh stay green while FGCS fails on delivery age and belief_vs_truth, establishing a false-healthy predicate distinct from link health.The predicate classifies most deliveries as Silent State Staleness when τfresh=150 ms.
  • 6.1 False-Healthy Headline: 11.62/12.16 s delivery age δ p50/p99 replaces tens-of-milliseconds freshness while OWD p99 remains 29.66 ms and availability reaches 99.96%.GUIDED mode remains active, failsafe is inactive, and physical tracking stays close to baseline.
  • 6.2 Video Feedback as Conditioner: With 8/12/24 Mbps video, δ remains on the order of 12 s and belief p99 reaches approximately 45–47 m, whereas video ablation leaves δ p99 at 65.3 ms and belief p99 at 1.07 m.The transition suggests a service-deficit or queue-instability regime rather than linear degradation with bitrate.
  • 6.3 Causal Attribution: UPF and host controls remain below saturation while UL UAV throughput falls to 8.04 Mbps, supporting PRB/grant contention in the gNB UL scheduler as the dominant cause.An uplink floor restores freshness under the same UPF and User Plane path.
  • 6.4 Dose Sweep Under Video Feedback: N=1 remains near baseline with δ p99 of 58.5 ms and belief of 1.07 m, while N≥2 increases staleness and N=2 causes δ p99 to jump to 7.48 s.The transition coincides with approaching the max_sched_ues limit at 106 PRB.
  • 6.5 Regime Sensitivity and Temporal Causality: At 51 PRB, δ p99 reaches 15.81 s and belief 54.14 m while OWD and tracking remain green, showing that the phenomenon persists and worsens with fewer UL symbols.False-healthy behavior appears at both 51 and 106 PRB.
  • 6.5 Regime Sensitivity and Temporal Causality: PRE remains in milliseconds, ATTACK saturates near 12 s, and DRAIN decays gradually while OWD p99 stays near 32 ms.This PRE/ATTACK/DRAIN signature supports queue drain under grant deficit while link monitoring misses the freshness collapse.

7 Mitigations and the Cost of Isolation

UL protection on the victim slice restores destination freshness, while the evaluation measures the associated isolation cost through throughput and reserved-resource waste. The tested protection benefit saturates early, but waste increases at higher floors.

  • 7.1 Isolation Cost Metrics: ReservationCost measures relative aggregate cell-throughput loss, with Tcell denoting aggregate cell throughput.The metric is paired with ReservationWaste to quantify the isolation tradeoff.
  • 7.1 Isolation Cost Metrics: ReservationWaste measures the fraction of reserved UL PRBs unused by the victim, using RUL for total reserved PRBs and Ursv for unused reserved PRBs.The metric is interpreted in the ATTACK window when the victim has active BSR.
  • 7.1 Isolation Cost Metrics: ReservationWaste rises from 0.50 at B20 to 0.87 at B80, making the cost of stronger isolation visible.In the measured range, ReservationCost remains approximately −0.71 and aggregate cell throughput is statistically unchanged relative to B0.
  • 7.2 Control Map: AQM leaves δ near 12 s, whereas MinRatio and attacker-side rate limiting restore freshness, identifying victim-slice UL protection as the appropriate Network Resource Model lever.The victim floor acts per S-NSSAI, while rate limiting acts on the attacking UE.
  • 7.2 Control Map: UL MinRatio restores δ p99 to 56–58 ms, belief p99 to 1.07 m, and UAV UL to approximately 12.5 Mbps.B=20 already provides δ p99 of 57.88±2.62 ms and UAV UL of 12.50±0.02 Mbps; higher floors provide little additional freshness benefit.
  • 7.2 Control Map: On the standard B0 testbed, δ p99 remains approximately 12.2 s, and restoring freshness requires the mitigation fork with the UL RRMPolicy patch and dedicated startup.Testing an already active partial UL policy would change the experimental condition because the floor is the defensive mechanism evaluated.
  • 7.3 Isolation Frontier: At 51 PRB, B20–B80 restores δ p99 to 52.6–55.2 ms and UAV UL to approximately 12.6–12.7 Mbps, while Waste ranges from 0.18 to 0.80.The same qualitative protection direction holds under lower bandwidth.

8 Discussion and Threats to Validity

The evaluation boundary is a controlled, single-stack testbed with soft or asymmetric uplink enforcement, while experiments isolate scheduler-driven aging and examine mitigation costs. The discussion also limits stealth to false-healthy connectivity indicators and notes dependencies on operational conditions and synthetic video.

  • Evaluation boundary: Results are bounded to a single OAI/ORANSlice implementation with ArduPilot SITL, soft isolation, and incomplete or asymmetric uplink enforcement.The authors describe this as a realistic class of 5G SA implementations, not an ad-hoc harness.
  • Causal attribution: Controlled rfsim experiments isolate uplink scheduler grant distribution by removing fading, mobility, and external interference.The study attributes the grant deficit to authorized neighbor demand under soft isolation; OTA validation remains future work.
  • Causal attribution: The headline aging magnitude remains near 12.6 s across max_sched_ues caps, linking it to uplink contention rather than the scheduler UE cap.This sweep supports the scheduler-contention interpretation within the tested setup.
  • Workload boundary: Synthetic, rate-matched video conditions the victim load, whereas adaptive-bitrate encoders could alter the instantaneous traffic pattern.ArduPilot SITL makes the separation between intact vehicle operation and outdated GCS state observable.
  • Stealth scope: The false-healthy predicate requires operational GUIDED connectivity and inactive failsafe while GCS freshness collapses, defining “silent” against conventional indicators.Heartbeats remain delivered under this operational definition.
  • Operational boundary: Operational impact depends on mission window, operator policy, video presence, adversarial dose, airspeed, and orbit geometry.The authors identify relating freshness divergence to operational envelopes as future work.

9 Related Work

FlyBlind extends related work by treating destination freshness as the attacked property in BVLOS over 5G, using an authorized co-tenant and cross-slice uplink contention rather than stronger adversaries or core-plane interference. It connects slice assurance and AoI perspectives to a false-healthy cyber-physical condition.

  • Positioning: FlyBlind compares related work across attacked freshness, authorized-adversary strength, false-healthy observability, and control-map dimensions.Table 9 marks presence, partial coverage, and absence across these axes.
  • UAS and 5G: An authorized co-tenant induces Silent State Staleness on the uplink while delivery age and belief_vs_truth diverge and conventional KPIs remain green.This provides the adversarial complement to prior benign BVLOS O-RAN work that left a pilot-side divergence metric open.
  • Noisy neighbor: Unlike core-plane noisy-neighbor studies at the UPF, FlyBlind examines uplink opportunity distribution between slices at the RAN.Its focus is before core GTP-U decapsulation.
  • Slicing assurance: FlyBlind reframes slice assurance from slice-level service objectives toward application-level freshness security.This extends work showing that RAN slice assurance does not by itself resolve application-level service assurance.
  • DoS comparison: FlyBlind preserves apparent availability while attacking state freshness, distinguishing its failure mode from resource-exhaustion DoS that prevents legitimate service use.The distinction is about the attacked property rather than disconnection.
  • Adversary model: Compared with rogue-gNB, side-channel, or jamming studies, FlyBlind uses authorized UEs generating legitimate uplink traffic.The adversary remains within the subscriber boundary.
  • Observability: FlyBlind formalizes a false-healthy state in which IP health and freshness health separate, applying differential-observability ideas to UAS over 5G.The paper connects this condition to monitoring the wrong property below the application layer.
  • Contribution boundary: FlyBlind uses AoI to expose a 5G SA security surface for BVLOS and combines freshness attacks, authorized adversaries, false-healthy detection, and cyber-physical evidence.The paper positions this combination as distinct from AoI theory, core noisy-neighbor work, and stronger radio attacks.

10 Conclusion

FlyBlind shows that BVLOS monitoring centered on link health can miss stale GCS state caused by authorized cross-slice uplink contention. The conclusion calls for freshness monitoring and uplink floors alongside conventional connectivity measures in the tested deployment class.

  • Finding: FlyBlind demonstrates Silent State Staleness: a co-tenant creates measurable GCS belief divergence while connectivity remains operational and the vehicle remains intact.The phenomenon is characterized as an adversarial cyber-physical gray failure.
  • Implication: Deployments with soft isolation and asymmetric uplink enforcement need per-S-NSSAI uplink floors and explicit freshness monitoring in addition to conventional link metrics.The authors note that these controls incur reservation costs operators must budget for.

Ethical Considerations

The study uses an isolated laboratory setup with authorized laboratory subscribers, synthetic video, and a closed ArduPilot SITL loop. Its defensive framing acknowledges dual-use risk while avoiding vendor-specific zero-day claims.

  • Study setting: Experiments used no third-party traffic or real aerial operation; video was synthetic and the cyber-physical loop ran in ArduPilot SITL.Adversarial UEs used only authorized laboratory SIMs, and no RAN, core, or MAVLink compromise was required.
  • Dual use: The authors identify dual-use risk because production deployment could make operators act on stale GCS state while conventional monitors remain green.They frame the artifacts as defensive instruments for hardening uplink isolation and freshness monitoring.

Open Science

The authors provide an anonymized artifact repository supporting reproduction of the experimental pipeline and central evaluations, while respecting third-party licensing and preserving double-blind review.

  • The repository includes testbed, network-slice, ArduPilot SITL, campaign-output, analysis, mitigation, and environment-documentation artifacts.Included components span Kind and Kubernetes scripts, OAI and ORANSlice configurations, frozen outputs, and analysis scripts.
  • The materials let readers reproduce the pipeline from deploying the sliced 5G SA testbed through recomputing freshness, belief, and isolation metrics.The documented sequence covers the UAV C2 loop, FlyBlind campaigns, and evaluation of the false-healthy predicate.
  • Third-party components remain cited and are obtained from upstream projects when redistribution licenses restrict inclusion.This applies to OAI, ORANSlice, and ArduPilot.
  • The repository is hosted anonymously with conference ID SEC27 during double-blind review and will become public after acceptance.The stated hosting arrangement preserves reviewer anonymity before publication.
Loading 2608.27604v1…