PaperlayerView exact revision on arXiv

Source-linked AI summary

O-RAN-Native Jamming Detection Under Network Heterogeneity

Sneihil Gopal, Fernando J. Cintrón, Richard A. Rouil

arXiv:2610.20816v1cs.LG

TL;DR

Heterogeneous O-RAN deployments need jamming detection that can operate despite distribution shift and unavailable labeled attack data. The paper proposes a two-mode statistical ensemble and evaluates it against learning-based models across eight 5G environments. SEM preserves detection under shift at the cost of false alarms, while multi-environment training improves learning-based results when the training corpus represents target conditions.

  • Problem

    Learning-based jamming detectors may struggle when deployment conditions differ from training and require labeled attack data that may be unavailable at rollout.

    Source: §I · p. 1

  • Method

    SEM combines baseline, count-based, and abrupt-change detectors through weighted voting, operating with unlabeled cold-start defaults and optional offline grid-search refinement.

    Source: §I · p. 1, A. Statistical Ensemble Method (SEM) · pp. 2–3

  • Results

    Under distribution shift, learning-based models can lose recall while SEM maintains detection at the cost of false alarms; multi-environment ML reaches mean F1-score 0.962, matching supervised SEM at 0.962.

    Source: §I · p. 1, §VII · p. 7

  • Takeaways & Limitations

    Multi-environment training improves learning-based performance, but corpus coverage of target conditions remains a primary constraint on generalization.

    Source: §I · p. 2, §VII · p. 7

    The benefit of multi-environment training depends on the corpus representing target deployment conditions, which cannot be guaranteed during initial rollout.

    Source: §I · p. 2

Abstract

from arXiv · show

Radio-frequency jamming threatens cellular network operations in contested environments. The Open Radio Access Network (O-RAN) architecture exposes per-User Equipment (UE) telemetry through the E2 interface, enabling Key Performance Indicator (KPI)-based jamming detection without proprietary hardware. However, operational deployment demands detection methods that generalize across heterogeneous networks. We propose a Statistical Ensemble Method (SEM) combining adaptive Median Absolute Deviation (MAD)-based baseline detection, count-based anomaly detection, and abrupt change detection through a weighted voting system. SEM operates in two modes: a cold-start mode requiring no labeled data for immediate deployment, and a supervised mode where parameters are refined offline via grid search as labeled data accumulates. We evaluate SEM against five machine learning (ML) classifiers and five deep learning (DL) sequence models using approximately 25 hours of testbed data comprising logs from eight heterogeneous 5G environments, employing both single-environment and multi-environment leave-one-out (LOO) validation. Our analysis indicates that under conditions not encountered during training (distribution shift), learning-based models tend to lose recall and miss jamming events, whereas SEM, even in cold-start mode, maintains detection capabilities at the cost of false alarms. Furthermore, SEM's parameter optimization can be mapped to O-RAN's Non-RT RIC as an rApp for continuous refinement, allowing operators to transition to learning-based alternatives once corpus coverage is sufficient.

I. INTRODUCTION

SEM is designed for heterogeneous O-RAN deployments where learning-based detectors face distribution shift and a lack of labeled attack data. The evaluation finds that SEM preserves detection under shift at the cost of false alarms, while the proposed two-mode design supports immediate detection and later refinement.

I. INTRODUCTION

  • O-RAN E2 reports expose per-UE KPI telemetry, including RSRP, SNR, and RSSI, to detection applications without proprietary instrumentation.Source: §I · p. 1
  • Learning-based models can struggle under distribution shift and require labeled attack data before deployment, which may be unavailable in a new environment.Source: §I · p. 1
  • SEM combines signal-characteristic detectors with default parameters for cold-start detection, then refines selected parameters offline by grid search as labeled data accumulates.The paper evaluates SEM against five ML classifiers and five DL sequence models on approximately 25 hours of logs from eight heterogeneous 5G environments using single- and multi-environment LOO validation.Source: §I · p. 1
  • On the most challenging log, single-environment ML and DL recall is 0.29 and 0.47, respectively, while cold-start SEM recall is 0.96.Under distribution shift, learning-based models can miss jamming events, whereas SEM maintains detection with additional false alarms.Source: §I · p. 1
  • Multi-environment training raises ML F1-score from 0.911 to 0.962 and DL F1-score from 0.897 to 0.956, but depends on training data representing target conditions.Corpus coverage, rather than hyperparameter configuration alone, is a primary constraint on generalization.Source: §I · p. 2
  • The proposed O-RAN deployment uses the near-RT RIC for immediate xApp detection and the non-RT RIC for rApp parameter refinement via grid search.Optimized parameters can be delivered through the A1 interface, enabling transition to supervised mode without interrupting live detection.Source: §I · p. 2

II. RELATED WORK

Prior jamming-detection studies span signal-level, statistical, KPI-based, and learning-based methods, but evaluations often use homogeneous conditions and supervised methods require labeled attack data. This work benchmarks across heterogeneous environments and compares detection architecture separately from the contribution of labeled data.

II. RELATED WORK

  • Prior work spans signal-level, threshold-based, KPI-statistical, and ML/DL jamming detection, while many evaluations use relatively homogeneous conditions.Threshold methods require manual site calibration, and supervised methods require labeled attack data before deployment.Source: §II · p. 2
  • The benchmark uses single- and multi-environment LOO validation across eight heterogeneous 5G logs to characterize distribution shift and compare methods under identical conditions.The authors describe this as, to their knowledge, the first comparison isolating detection architecture from labeled-data contribution.Source: §II · p. 2

III. METHODOLOGY

  • The methodology section outlines SEM, learning-based models, and the validation approach for assessing generalization across heterogeneous deployment conditions.Source: §III · p. 2

A. Statistical Ensemble Method (SEM)

SEM processes per-UE KPI telemetry without a training phase by combining three detectors with weighted voting. Signal-physics defaults enable cold start, while selected fusion and post-processing parameters can be refined offline using labeled data.

A. Statistical Ensemble Method (SEM)

  • SEM combines baseline, count-based, and abrupt-change detectors through weighted voting; cold-start defaults require no labeled data, while selected parameters are refined offline by grid search.Tier 1 parameters use signal-physics principles; Tier 2 covers detector, fusion, and post-processing refinements.Source: A. Statistical Ensemble Method (SEM) · pp. 2–3
  • The baseline detector flags a sample when any channel’s modified z-score exceeds τz; its default cold-start threshold is 3.0.Rolling median and MAD adapt the baseline to local conditions and reduce sensitivity to long-term signal drift; short series use global median and MAD.Source: A. Statistical Ensemble Method (SEM) · p. 2
  • The count detector flags zero RSRP samples and abrupt count changes above an adaptive threshold based on local rolling standard deviation.Zero-count events are absent in normal operation in the collected logs, and the adaptive threshold can be refined through supervised grid search.Source: A. Statistical Ensemble Method (SEM) · pp. 2–3
  • The abrupt-change detector flags first-order KPI differences above a threshold scaled to each signal’s dynamic range, using default pc = 0.4.Sustained KPI reporting gaps are also treated as implicit anomalies because jammer-induced receiver disruption can cause measurement loss.Source: A. Statistical Ensemble Method (SEM) · p. 3
  • The hybrid decision gives the count detector unconditional priority and requires the remaining detectors to reach a confidence threshold before contributing.All reported results use the hybrid mask, which outperformed union and weighted variants by reducing false alarms while preserving recall; short detections are suppressed and nearby detections merged.Source: A. Statistical Ensemble Method (SEM) · p. 3

B. Learning-Based Models

The learning-based baselines comprise five conventional classifiers and five sequence models, trained on a shared engineered representation of nine KPI channels. ML uses feature vectors, while DL models process sequences of those vectors.

B. Learning-Based Models

  • The evaluation covers five ML classifiers and five DL sequence architectures, including tree-based, linear, recurrent, convolutional, and temporal-convolutional models.Source: B. Learning-Based Models · p. 3
  • The shared pipeline derives rolling, lagged, change, volatility, cross-KPI, and selected frequency features, producing approximately 423 features per sample when all nine KPI channels are available.Feature scaling is fitted on training data and applied to validation and test data.Source: B. Learning-Based Models · p. 3
  • ML models use feature vectors directly, whereas DL models process sequences of 10 consecutive feature vectors to capture temporal dependencies.Source: B. Learning-Based Models · p. 3
  • DL models use class-weighted binary crossentropy and validation-based early stopping; the highest test-set F1 model in each family is reported per fold.Source: B. Learning-Based Models · p. 3

C. Validation Methodology

Validation compares within-log testing with testing on a fully held-out environment. SEM uses no model training in either regime, with supervised SEM instead refining parameters using labeled data.

C. Validation Methodology

  • Single-environment validation temporally splits each log into 70% training, 15% validation, and 15% testing to represent the same network conditions.The test boundary may be adjusted to include both jamming and non-jamming samples.Source: C. Validation Methodology · p. 3
  • Multi-environment LOO trains on seven logs and tests on the eighth, directly assessing generalization to an environment excluded from training.Each log serves as the held-out test environment once; DL models also use a training-corpus validation subset for early stopping.Source: C. Validation Methodology · p. 3
  • SEM uses default parameters in cold-start mode and grid-search refinement in supervised mode, independent of the ML/DL training regime; cold-start results are identical across regimes.Source: C. Validation Methodology · p. 3

IV. EXPERIMENTAL SETUP

The experimental dataset comprises eight labeled jamming logs collected over approximately 25 hours on a 5G NR testbed. Its variation in UE count, sample volume, and burst patterns probes performance across deployment conditions.

IV. EXPERIMENTAL SETUP

  • Table I summarizes the dataset used to assess the proposed and learning-based methods under varying deployment conditions.Source: §IV · p. 3, Table I · p. 4

A. Dataset

  • Eight logs collected over approximately 25 hours on a Band N78 5G NR testbed form the dataset, with manually verified jamming-interval labels.The testbed used 45 dB and 48 dB jamming gains; network traffic ranged from idle to 11 Mb/s downlink and included ICMP ping traffic.Source: A. Dataset · p. 4
  • The dataset varies UE count from 1 to 3, sample volume from 926 to 65,075, and jamming bursts from fixed 30- or 60-second patterns to variable 10–30-second patterns.Variable bursts are the dataset's primary source of distribution shift during multi-environment validation.Source: A. Dataset · p. 4

B. KPI Features

The methods use nine KPI channels, with learning-based models receiving engineered features and SEM operating directly on the original channels. Evaluation reports five sample-level metrics per held-out log and uses eight-log means for overall performance.

B. KPI Features

  • Nine KPI channels capture received-signal strength, measurement availability, and noise or interference changes: RSRP statistics and count, downlink RSSI, and uplink SNR.Source: B. KPI Features · p. 4
  • Fig. 1 reports per-fold values for five metrics for supervised SEM and the best-performing ML and DL models under both validation regimes.Source: Figure 1 · p. 4
  • Learning-based methods use engineered features and sequences of 10 feature vectors for DL, whereas SEM uses the nine original KPI channels directly.The feature pipeline produces approximately 423 features per sample when all nine channels are available.Source: B. KPI Features · p. 4

C. Evaluation Metrics

  • Sample-level F1-score, precision, recall, accuracy, and specificity are computed per held-out log and averaged across eight logs; recall is interpreted alongside F1-score because missed jamming can carry greater operational consequences than false alarms.Specificity indicates the ability to identify non-jamming samples and thus provides an indication of false-alarm behavior.Source: C. Evaluation Metrics · p. 4

V. RESULTS

Across the eight logs, cold-start SEM achieves high recall without labeled data, while grid search improves its mean F1-score. Multi-environment training raises ML and DL F1-scores, with recovery linked primarily to training-corpus diversity.

A. Overall Performance

  • Cold-start SEM reaches mean F1-score 0.888 without labeled data and recall 0.971, versus single-environment ML's F1-score 0.911 and recall 0.890, with lower precision and more false alarms.Its precision is 0.826 compared with ML's 0.984; the reported F1-score gap is 0.023 points.Source: A. Overall Performance · p. 5, Table II · p. 5
  • Grid search raises supervised SEM's mean F1-score by +0.074 to 0.962, with the largest gains in Log 6 (+0.195) and Log 8 (+0.151).Log 6 has 926 samples and short-duration adaptive-windowing instability; Log 8 is an 18-hour low-gain run.Source: A. Overall Performance · p. 5
  • Multi-environment training raises ML F1-score from 0.911 to 0.962 and DL F1-score from 0.897 to 0.956, primarily through training-data diversity rather than hyperparameter selection.The table summarizes mean performance across eight logs.Source: A. Overall Performance · p. 5, Table II · p. 5

B. Distribution Shift Analysis

Performance across the eight logs varies with signal strength, recording length, burst patterns, and how well training data represents the held-out environment. The sharpest distribution shift shows cold-start SEM preserving detection, while learning-based performance depends on exposure to representative conditions.

Stable high-gain conditions

  • On stable high-gain Logs 1 and 2, supervised SEM and learning-based methods reach approximately 0.98 F1-score or higher, while cold-start SEM reaches 0.93–0.97 without labeled data.Strong interference signatures, sufficient samples, and regular bursts support effective detection across methods and training strategies.Source: B. Distribution Shift Analysis · p. 5

Variable burst pattern, distribution shift regime

  • On Log 7, cold-start SEM reaches 0.93 F1-score and 0.96 recall, versus single-environment ML at 0.45 F1-score and 0.29 recall and DL at 0.64 F1-score and 0.47 recall.Under multi-environment training, ML and DL recover to approximately 0.98 F1-score, but prior exposure to similar variable-burst behavior is needed.Source: B. Distribution Shift Analysis · pp. 5–6, Table III · p. 6

Sparse data and short recordings

  • On sparse, short Logs 3, 4, and 6, supervised SEM maintains F1-scores of 0.97–0.98, while cold-start SEM falls to 0.78 F1-score and 0.69 precision on Log 6.The 50-sample rolling window is about 5% of Log 6’s 926 samples, making its adaptive baseline more sensitive to recording duration.Source: B. Distribution Shift Analysis · p. 5

Large dataset with underrepresented conditions

  • On Log 8, ML and DL F1-scores decline from 0.99 and 0.98 in single-environment validation to 0.89 in multi-environment validation, as the training logs underrepresent its long-duration, low-gain, variable-burst conditions.Supervised SEM remains at approximately 0.88 in both regimes; training-set size and coverage are distinct, and more data helps only when it captures likely deployment conditions.Source: B. Distribution Shift Analysis · p. 6

C. Failure Mode Analysis

SEM’s cold-start mode retains recall under Log 7’s challenging distribution shift, while single-environment learning-based models miss many jamming samples. Individual model results vary, and the O-RAN deployment sequence supports immediate detection, later parameter refinement, and an optional learning-based transition when training data covers deployment conditions.

C. Failure Mode Analysis

  • On Log 7, single-environment ML and DL recall falls to 0.29 and 0.47, while cold-start SEM retains recall, with additional false alarms; the paper describes missed jamming as operationally unacceptable in military C2 networks.SEM’s reduced precision is contrasted with learning-based models’ undetected jamming samples.Source: C. Failure Mode Analysis · p. 6

D. Individual Model Analysis

  • Among individual models, LightGBM leads single-environment ML at 0.91 F1-score and 1D-CNN leads DL at 0.88; under multi-environment training, RF reaches 0.96 and XGBoost, 1D-CNN, and CNN-LSTM reach 0.94.Under multi-environment training, SVM scores 0.20 and TCN 0.10 F1-score.Source: D. Individual Model Analysis · pp. 6–7

VI. O-RAN DEPLOYMENT IMPLICATIONS

  • Phase 1 deploys SEM with default parameters as a near-RT RIC xApp for immediate detection; mean precision is 0.826, while recall remains at least 0.88 across conditions.False alarms are elevated in very short recordings and long-duration, low-gain conditions.Source: §VI · p. 7
  • Phase 2 uses a Non-RT RIC rApp to refine parameters by grid search and deliver them over A1 without interrupting detection; F1-score gains reach +0.195 for Log 6-type recordings and +0.151 for Log 8-type conditions.Log 3 improves by +0.070, and the other five logs gain approximately +0.018 to +0.046.Source: §VI · p. 7
  • Phase 3 permits transition to learning-based alternatives once the dataset covers target conditions and held-out performance reaches parity; multi-environment ML and supervised SEM each achieve mean F1-score of 0.962.SEM remains available as a fallback because multi-environment training may not help when target conditions are underrepresented.Source: §VI · p. 7

VII. CONCLUSION

The paper presents SEM for O-RAN-native jamming detection and finds that it preserves detection capability at the cost of false alarms under distribution shifts. Multi-environment ML matches supervised SEM in mean F1-score, but learning-based generalization depends on training-corpus coverage.

VII. CONCLUSION

  • Under distribution shifts, learning-based models struggle to retain recall, while SEM tends to preserve detection capability at the cost of additional false alarms.The conclusion reports that supervised SEM outperforms single-environment learning-based methods in mean F1-score.Source: §VII · p. 7
  • Multi-environment ML achieves mean F1-score of 0.962, matching supervised SEM at 0.962, while individual-log performance varies substantially.Multi-environment training raises ML F1-score from 0.911 to 0.962 and DL from 0.897 to 0.956.Source: §VII · p. 7
  • The results identify corpus coverage as a key limitation for learning-based methods in heterogeneous environments.The reported gains from multi-environment training depend on diverse training data.Source: §VII · p. 7
Loading 2610.20816v1…