Cross-Layer Intrusion Detection in 5G O-RAN: Gains and Limits of Fusing Radio Telemetry with Network Flow Records

• URL: http://arxiv.org/abs/2606.22450v1
• Date: Sun, 21 Jun 2026 11:48:23 GMT
• Title: Cross-Layer Intrusion Detection in 5G O-RAN: Gains and Limits of Fusing Radio Telemetry with Network Flow Records
• Abstract summary: Open RAN disaggregation enables joint analysis of DU radio telemetry and CU-side network-flow records.<n>We evaluate whether fusing these two modalities improves over each individually across seven architectures.
• Score: 2.992414059774663
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Open RAN disaggregation enables joint analysis of DU radio telemetry and CU-side network-flow records, motivating cross-layer intrusion detection. We evaluate whether fusing these two modalities improves over each individually across seven architectures, using run-disjoint splits over ten seeds on a live 5G O-RAN dataset. Radio features match or outperform network flows on ROC-AUC and run-level detection rate across all architectures. Fusion yields selective ROC-AUC gains but at a one-percent false-positive operating point improves detection rate only for GRU and Transformer, reducing it for the other five models. The benefit is confined to architectures where both single-modality detection rates fall below 0.75. A DoS-to-Benign confusion of 27 to 46 percent persists across all 42 tested configurations of architecture, modality, and window duration, pointing to a limitation in the tested windowed statistical aggregation rather than in model capacity. Code is publicly available.

Related papers

• Boundary-Aligned Contribution Routing for Robust Optical--SAR Object Detection [8.665369041430969]
  optical--SAR fusion is attractive for remote-sensing object detection.<n>But imperfect spatial, temporal, and semantic correspondence can make an otherwise intact stream conditionally harmful.<n>We learn task-conditioned contribution routing using detection supervision alone.
  arXiv  Detail & Related papers  (2026-08-15T14:37:23Z)
• FreqKD: Frequency-Decoupled Cross-Modal Knowledge Distillation for Infrared Object Detection [2.4089107936585235]
  Transfer learning from large-scale RGB foundation models to infrared (IR) imagery through knowledge distillation (KD) remains challenging.<n>We propose FreqKD, a frequency-decoupled distillation framework that applies asymmetric supervision adapted to each band's cross-modal consistency.<n>On KAIST multispectral pedestrian detection, FreqKD achieves 64.1 mAP50, improving 2.4 points over the DINOv2 baseline.
  arXiv  Detail & Related papers  (2026-06-10T01:55:55Z)
• Rethinking IoT Intrusion Detection: Augmenting Routing Metrics with Radio Features [0.9176056742068813]
  We investigate whether incorporating Transmit (TX) and Receive (RX) radio features alongside the standard RPL feature set can improve detection performance in an LSTM-based IDS.<n>The results show that incorporating TX and RX improves the IDS's overall detection performance by up to 4% in F1-score compared with using routing-layer features alone.
  arXiv  Detail & Related papers  (2026-06-05T13:56:55Z)
• TransBridge: Boost 3D Object Detection by Scene-Level Completion with Transformer Decoder [66.22997415145467]
  This paper presents a joint completion and detection framework that improves the detection feature in sparse areas.<n> Specifically, we propose TransBridge, a novel transformer-based up-sampling block that fuses the features from the detection and completion networks.<n>The results show that our framework consistently improves end-to-end 3D object detection, with the mean average precision (mAP) ranging from 0.7 to 1.5 across multiple methods.
  arXiv  Detail & Related papers  (2025-12-12T00:08:03Z)
• Source-Free Object Detection with Detection Transformer [59.33653163035064]
  Source-Free Object Detection (SFOD) enables knowledge transfer from a source domain to an unsupervised target domain for object detection without access to source data.<n>Most existing SFOD approaches are either confined to conventional object detection (OD) models like Faster R-CNN or designed as general solutions without tailored adaptations for novel OD architectures, especially Detection Transformer (DETR)<n>In this paper, we introduce Feature Reweighting ANd Contrastive Learning NetworK (FRANCK), a novel SFOD framework specifically designed to perform query-centric feature enhancement for DETRs.
  arXiv  Detail & Related papers  (2025-10-13T07:35:04Z)
• LLM-Based Emulation of the Radio Resource Control Layer: Towards AI-Native RAN Protocols [28.04609776570199]
  Large AI Models (LAMs) are key enablers of the AI-Native Air Interface (AI-AI)<n>This paper presents the first standards-compliant emulation of the Radio Resource Control layer using a decoder-only LAM.<n>Results demonstrate that LAMs, when augmented with protocol-aware reasoning, can directly orchestrate control-plane procedures.
  arXiv  Detail & Related papers  (2025-05-22T15:55:56Z)
• A Two-Stage CAE-Based Federated Learning Framework for Efficient Jamming Detection in 5G Networks [5.715528540446773]
  jamming attacks pose a significant risk to heterogeneous network (HetNet) architectures.<n>This paper proposes a decentralized two-stage federated learning (FL) framework for jamming detection in 5G femtocells.<n>Our framework achieves a precision of 0.94, recall of 0.90, F1-score of 0.92, and an accuracy of 0.92, while minimizing communication rounds to 30 and achieving robust convergence in detecting jammed signals with an optimal client count of 6.
  arXiv  Detail & Related papers  (2025-01-25T17:57:45Z)
• DT-DDNN: A Physical Layer Security Attack Detector in 5G RF Domain for CAVs [10.215216950059874]
  jamming attacks pose substantial risks to the 5G network.<n>This work presents a novel deep learning-based technique for detecting jammers in CAV networks.<n>Results show that the proposed method achieves 96.4% detection rate in extra low jamming power.
  arXiv  Detail & Related papers  (2024-03-05T04:29:31Z)
• MD-CSDNetwork: Multi-Domain Cross Stitched Network for Deepfake Detection [80.83725644958633]
  Current deepfake generation methods leave discriminative artifacts in the frequency spectrum of fake images and videos. We present a novel approach, termed as MD-CSDNetwork, for combining the features in the spatial and frequency domains to mine a shared discriminative representation.
  arXiv  Detail & Related papers  (2021-09-15T14:11:53Z)
• Anchor-free Small-scale Multispectral Pedestrian Detection [88.7497134369344]
  We propose a method for effective and efficient multispectral fusion of the two modalities in an adapted single-stage anchor-free base architecture. We aim at learning pedestrian representations based on object center and scale rather than direct bounding box predictions. Results show our method's effectiveness in detecting small-scaled pedestrians.
  arXiv  Detail & Related papers  (2020-08-19T13:13:01Z)
• Network Adjustment: Channel Search Guided by FLOPs Utilization Ratio [101.84651388520584]
  This paper presents a new framework named network adjustment, which considers network accuracy as a function of FLOPs. Experiments on standard image classification datasets and a wide range of base networks demonstrate the effectiveness of our approach.
  arXiv  Detail & Related papers  (2020-04-06T15:51:00Z)
• Searching Central Difference Convolutional Networks for Face Anti-Spoofing [68.77468465774267]
  Face anti-spoofing (FAS) plays a vital role in face recognition systems. Most state-of-the-art FAS methods rely on stacked convolutions and expert-designed network. Here we propose a novel frame level FAS method based on Central Difference Convolution (CDC)
  arXiv  Detail & Related papers  (2020-03-09T12:48:37Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.