DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR

• URL: http://arxiv.org/abs/2607.16102v1
• Date: Fri, 17 Jul 2026 16:37:36 GMT
• Title: DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR
• Abstract summary: 5G systems are vulnerable to smart jamming attacks that can propagate to applications running on top of these networks.<n>We present DoSQ, a protocol-aware attack that decodes per-slot DCI to inject interference onto the victim UE's Physical Resource Blocks.<n>We also propose an SSB frequency-time-hopping countermeasure that increases the attacker's resynchronization cost.
• Score: 1.9336815376402718
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The 3rd Generation Partnership Project (3GPP)'s Fifth Generation New Radio (5G NR) is critical to supporting mission-critical services. However, 5G systems are vulnerable to smart jamming attacks that can propagate to applications running on top of these networks (i.e., cross-layer). The 5G gNB broadcasts resource scheduling information for the legitimate UEs over the air interface, with a prevailing assumption that this surface alone reveals nothing useful about a user device. However, we show that using the Downlink Control Information (DCI) is sufficient to degrade Application layer service quality, i.e., Denial of Service Quality (DoSQ), by inferring the Application layer Goodput (i.e., via side-channel analysis). Therefore, we present DoSQ, a protocol-aware attack that decodes per-slot DCI to inject interference onto the victim UE's Physical Resource Blocks (PRBs) within the same 1 ms slot, while a cross-layer classifier estimates the victim's Goodput state and trend from DCI features alone, without observing a single encrypted byte. Evaluated on a private 5G NR testbed against YouTube Live, DoSQ drives the target's Goodput down by up to 50% at sparse hit-rates, while a co-located non-target UE remains largely unaffected. Moreover, the classifier achieves a precision of 0.87 at the top 1% of attack-now confidence, a 4.21 times lift over the base rate. Furthermore, we propose an SSB frequency-time-hopping countermeasure that increases the attacker's resynchronization cost. The result is the first empirical measurement of a radio-to-application side channel that any protocol-aware adversary can exploit.

Related papers

• 5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information (long version) [4.294205370255953]
  We present a novel technique to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline.<n>We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors.
  arXiv  Detail & Related papers  (2026-09-07T11:39:52Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems [56.613157564882925]
  Malicious behaviors are embedded in seemingly benign tools, silently hijacking agent execution, leaking sensitive data, or triggering unauthorized actions.<n>Despite their growing impact, there is currently no comprehensive benchmark for evaluating such threats.<n>We propose ShieldNet, a network-level guardrail framework that detects supply-chain poisoning by observing real network interactions.
  arXiv  Detail & Related papers  (2026-04-06T05:15:00Z)
• Empowering Mobile Networks Security Resilience by using Post-Quantum Cryptography [0.05461938536945721]
  We experimentally integrate NIST-standardized ML-KEM-768 and ML-DSA into an open-source 5G core (free5GC) using a sidecar proxy pattern that preserves network functions (NFs)<n>Results show that sidecar-based PQC insertion enables a non-disruptive and operationally predictable migration path for quantum-resilient 5G signaling.
  arXiv  Detail & Related papers  (2026-03-30T16:09:56Z)
• BiRQA: Bidirectional Robust Quality Assessment for Images [49.74447451098852]
  Full-Reference image quality assessment (FR IQA) is important for image compression, restoration and generative modeling.<n>We present BiRQA, a compact FR IQA metric model that processes four fast complementary features within a bidirectional multiscale pyramid.<n>On five public FR IQA benchmarks BiRQA outperforms or matches the previous state of the art (SOTA) while running 3x faster than previous SOTA models.
  arXiv  Detail & Related papers  (2026-02-23T20:52:56Z)
• Breaking 5G on The Lower Layer [9.311361097270153]
  We explore lower-layer exploitation in modern 5G.<n>Recent releases have increased the number of lower-layer control messages and procedures.<n>We present two practical attacks and evaluate them in a controlled lab testbed.
  arXiv  Detail & Related papers  (2026-02-10T19:54:32Z)
• Bit-Flipping Attack Exploration and Countermeasure in 5G Network [3.0524801814543]
  We investigate the vulnerability of 5G systems to bit-flipping attacks, which is an integrity attack where an adversary intercepts 5G network traffic and modifies specific fields of an encrypted message without decryption, thus mutating the message while remaining valid to the receiver.<n>We propose a keystream-based shuffling defense mechanism to mitigate the effect of such attacks by raising the difficulty of manipulating specific encrypted fields, while introducing no additional communication overhead compared to the NAS Integrity Algorithm (NIA) in 5G.
  arXiv  Detail & Related papers  (2025-11-06T23:51:28Z)
• Integrity Under Siege: A Rogue gNodeB's Manipulation of 5G Network Slice Allocation [2.90110037823427]
  5G networks, with network slicing as a cornerstone technology, promises customized, high-performance services, but also introduces novel attack surfaces beyond traditional threats.<n>This article investigates a critical and underexplored integrity vulnerability: the manipulation of network slice allocation to compromise Quality of Service (QoS) and resource integrity.<n>We show how a rogue gNodeB acting as a Man-in-the-Middle can exploit protocol weaknesses to forge slice requests and hijack a User Equipment's connection.
  arXiv  Detail & Related papers  (2025-11-05T09:26:39Z)
• Cross-Service Token: Finding Attacks in 5G Core Networks [58.86003502940164]
  We present FivGeeFuzz, a grammar-based fuzzing framework designed to uncover security flaws in 5G core SBIs.<n>Using FivGeeFuzz, we discovered 8 previously unknown vulnerabilities in free5GC, leading to runtime crashes, improper error handling, and unauthorized access to resources.
  arXiv  Detail & Related papers  (2025-09-10T20:40:33Z)
• Fooling the Decoder: An Adversarial Attack on Quantum Error Correction [49.48516314472825]
  In this work, we target a basic RL surface code decoder (DeepQ) to create the first adversarial attack on quantum error correction.<n>We demonstrate an attack that reduces the logical qubit lifetime in memory experiments by up to five orders of magnitude.<n>This attack highlights the susceptibility of machine learning-based QEC and underscores the importance of further research into robust QEC methods.
  arXiv  Detail & Related papers  (2025-04-28T10:10:05Z)
• TIMESAFE: Timing Interruption Monitoring and Security Assessment for Fronthaul Environments [19.41373608625999]
  We show how a spoofing attack is able to cause a production-ready O-RAN and 5G-compliant private cellular base station to catastrophically fail within 2 seconds of the attack.<n>We design a Machine Learning-based monitoring solution capable of detecting various malicious attacks with over 97.5% accuracy.
  arXiv  Detail & Related papers  (2024-12-17T16:13:37Z)
• WNARS: WFST based Non-autoregressive Streaming End-to-End Speech Recognition [59.975078145303605]
  We propose a novel framework, namely WNARS, using hybrid CTC-attention AED models and weighted finite-state transducers. On the AISHELL-1 task, our WNARS achieves a character error rate of 5.22% with 640ms latency, to the best of our knowledge, which is the state-of-the-art performance for online ASR.
  arXiv  Detail & Related papers  (2021-04-08T07:56:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.