StormShield: Fingerprint-Based Detection and Mitigation of RRC Signaling Storms in O-RAN 5G RANs

• URL: http://arxiv.org/abs/2605.14032v1
• Date: Wed, 13 May 2026 18:45:50 GMT
• Title: StormShield: Fingerprint-Based Detection and Mitigation of RRC Signaling Storms in O-RAN 5G RANs
• Abstract summary: StormShield is a signaling storm attack detection and mitigation technique implemented as an xApp on an O-RAN Near-Real-Time (near-RT) RAN Intelligent Controller (RIC)<n>It fingerprints and blocks Malicious UEs (MUEs) before gNB resources are exhausted.<n>Our experimental evaluation demonstrates that StormShield effectively prevents gNB resource exhaustion, identifying and blocking MUEs with an average detection accuracy of 97.6% within 106.5 ms from the beginning of the attack.
• Score: 13.008097694817062
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: 5G networks provide low-latency, high throughput, and massive connectivity, yet the control plane remains exposed to several security threats. Among the most common and impactful threats are Denial-of-Service (DoS) attacks, with Radio Resource Control (RRC) signaling storms being particularly effective and difficult to mitigate. In this attack, a malicious User Equipment (UE) aims to exhaust Next Generation Node Base (gNB) resources, preventing legitimate UEs from establishing a connection. Existing defenses are typically limited to detection, only evaluated through numerical simulations, and cannot discern between high-load network conditions and attacks. Most of them also assume static setups and do not take mobility into account. In this paper, we first evaluate the feasibility of the signaling storm attack by using the OpenAirInterface(OAI) 5G protocol stack. Then, we propose StormShield, a signaling storm attack detection and mitigation technique implemented as an xApp on an O-RAN Near-Real-Time (near-RT) RAN Intelligent Controller (RIC). It fingerprints and blocks Malicious UEs (MUEs) before gNB resources are exhausted. We prototyped our solution on an Over-The-Air (OTA) testbed with OAI, NVIDIA Aerial, and two different gNB setups. The first one leverages an USRP X410 Software-defined Radio (SDR) with 8.1 functional split; the second a commercial Foxconn Radio Unit (RU) with 7.2 functional split. Our experimental evaluation demonstrates that StormShield effectively prevents gNB resource exhaustion, identifying and blocking MUEs with an average detection accuracy of 97.6% within 106.5 ms from the beginning of the attack.

Related papers

• Experimental Validation and Mitigation of RRC Storm Attacks in 5G Cellular Networks [0.2750124853532832]
  We implement a signaling storm attack on a real testbed composed of software-defined radios and commercial phones.<n>We then design and implement a lightweight mitigation technique that operates directly at the gNB by monitoring and acting on suspicious half-open connections.<n>The work is released as open source so that other researchers can reproduce our results, build on the implementation, and evaluate new mitigation strategies.
  arXiv  Detail & Related papers  (2026-08-17T11:38:33Z)
• ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems [56.613157564882925]
  Malicious behaviors are embedded in seemingly benign tools, silently hijacking agent execution, leaking sensitive data, or triggering unauthorized actions.<n>Despite their growing impact, there is currently no comprehensive benchmark for evaluating such threats.<n>We propose ShieldNet, a network-level guardrail framework that detects supply-chain poisoning by observing real network interactions.
  arXiv  Detail & Related papers  (2026-04-06T05:15:00Z)
• RRC Signaling Storm Detection in O-RAN [0.0]
  Signaling storms caused by abuse of the Radio Resource Control protocol are a critical threat to 5G availability.<n>We develop a threshold-based detection technique that relies on RRC layer features to distinguish between malicious activity and legitimate high network load conditions.
  arXiv  Detail & Related papers  (2025-04-22T09:32:11Z)
• A Zero Trust Framework for Realization and Defense Against Generative AI Attacks in Power Grid [62.91192307098067]
  This paper proposes a novel zero trust framework for a power grid supply chain (PGSC) It facilitates early detection of potential GenAI-driven attack vectors, assessment of tail risk-based stability measures, and mitigation of such threats. Experimental results show that the proposed zero trust framework achieves an accuracy of 95.7% on attack vector generation, a risk measure of 9.61% for a 95% stable PGSC, and a 99% confidence in defense against GenAI-driven attack.
  arXiv  Detail & Related papers  (2024-03-11T02:47:21Z)
• Deep Attention Recognition for Attack Identification in 5G UAV scenarios: Novel Architecture and End-to-End Evaluation [3.3253720226707992]
  Despite the robust security features inherent in the 5G framework, attackers will still discover ways to disrupt 5G unmanned aerial vehicle (UAV) operations. We propose Deep Attention Recognition (DAtR) as a solution to identify attacks based on a small deep network embedded in authenticated UAVs.
  arXiv  Detail & Related papers  (2023-03-03T17:10:35Z)
• Attacking Important Pixels for Anchor-free Detectors [47.524554948433995]
  Existing adversarial attacks on object detection focus on attacking anchor-based detectors. We propose the first adversarial attack dedicated to anchor-free detectors. Our proposed methods achieve state-of-the-art attack performance and transferability on both object detection and human pose estimation tasks.
  arXiv  Detail & Related papers  (2023-01-26T23:03:03Z)
• A Convolutional Attention Based Deep Network Solution for UAV Network Attack Recognition over Fading Channels and Interference [3.1230069539161405]
  This research offers a deep learning (DL) approach for detecting attacks in UAVs equipped with multiplexing (OFDM) receivers on Clustered Delay Line (CDL) channels. The prospective algorithm is generalizable regarding attack identification, which does not occur during training. A deeper investigation into the timing requirements for recognizing attacks show that after training, the minimum time necessary after the attack begins is 100 ms.
  arXiv  Detail & Related papers  (2022-07-16T22:08:12Z)
• Mixture GAN For Modulation Classification Resiliency Against Adversarial Attacks [55.92475932732775]
  We propose a novel generative adversarial network (GAN)-based countermeasure approach. GAN-based aims to eliminate the adversarial attack examples before feeding to the DNN-based classifier. Simulation results show the effectiveness of our proposed defense GAN so that it could enhance the accuracy of the DNN-based AMC under adversarial attacks to 81%, approximately.
  arXiv  Detail & Related papers  (2022-05-29T22:30:32Z)
• Two methods for Jamming Identification in UAVs Networks using New Synthetic Dataset [3.473643536900493]
  This paper presents two strategies to identify Jammers in UAV networks. The first strategy is based on time series approaches for anomaly detection. The second is based on newly designed deep networks.
  arXiv  Detail & Related papers  (2022-03-21T22:32:37Z)
• Adversarial Attacks on Deep Learning Based mmWave Beam Prediction in 5G and Beyond [46.34482158291128]
  A deep neural network (DNN) can predict the beam that is best slanted to each UE by using the received signal strengths ( RSSs) from a subset of possible narrow beams. We present an adversarial attack by generating perturbations to manipulate the over-the-air captured RSSs as the input to the DNN. This attack reduces the IA performance significantly and fools the DNN into choosing the beams with small RSSs compared to jamming attacks with Gaussian or uniform noise.
  arXiv  Detail & Related papers  (2021-03-25T17:25:21Z)
• TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack [46.79557381882643]
  We present TANTRA, a novel end-to-end Timing-based Adversarial Network Traffic Reshaping Attack. Our evasion attack utilizes a long short-term memory (LSTM) deep neural network (DNN) which is trained to learn the time differences between the target network's benign packets. TANTRA achieves an average success rate of 99.99% in network intrusion detection system evasion.
  arXiv  Detail & Related papers  (2021-03-10T19:03:38Z)
• Multi-stage Jamming Attacks Detection using Deep Learning Combined with Kernelized Support Vector Machine in 5G Cloud Radio Access Networks [17.2528983535773]
  This research focuses on deploying a multi-stage machine learning-based intrusion detection (ML-IDS) in 5G C-RAN. It can detect and classify four types of jamming attacks: constant jamming, random jamming, jamming, and reactive jamming. The final classification accuracy of attacks is 94.51% with a 7.84% false negative rate.
  arXiv  Detail & Related papers  (2020-04-13T17:21:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.