Experimental Validation and Mitigation of RRC Storm Attacks in 5G Cellular Networks

• URL: http://arxiv.org/abs/2608.16441v2
• Date: Sun, 23 Aug 2026 12:46:21 GMT
• Title: Experimental Validation and Mitigation of RRC Storm Attacks in 5G Cellular Networks
• Abstract summary: We implement a signaling storm attack on a real testbed composed of software-defined radios and commercial phones.<n>We then design and implement a lightweight mitigation technique that operates directly at the gNB by monitoring and acting on suspicious half-open connections.<n>The work is released as open source so that other researchers can reproduce our results, build on the implementation, and evaluate new mitigation strategies.
• Score: 0.2750124853532832
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The initial access phase of the 5G system remains sensitive because the base station (gNB) must allocate radio resources before the user is fully authenticated. In particular, the random access channel (RACH) procedure can be abused to generate large numbers of incomplete connection attempts, creating a signaling storm that consumes gNB resources and prevents legitimate users from connecting successfully. In this paper, we implement this signaling storm attack using the OpenAirInterface project and validate it on a real testbed composed of software-defined radios and commercial phones. We then design and implement a lightweight mitigation technique that operates directly at the gNB by monitoring and acting on suspicious half-open connections. To make the system observable in practice, we also develop a network management interface that visualizes the network state in real time and highlights suspicious activity during the attack phase. Finally, the work is released as open source so that other researchers can reproduce our results, build on the implementation, and evaluate new mitigation strategies.

Related papers

• Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning [78.29352305480285]
  In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds.<n>This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement.
  arXiv  Detail & Related papers  (2026-08-22T18:38:39Z)
• Model Forensics in AI-Native Wireless Networks: Taxonomy, Applications, and Case Study [60.8789758039936]
  We focus on model forensics in AI-native wireless networks.<n>Key problems include model authenticity verification, malicious function identification and accountability tracing.<n>Results show that model forensics can provide important support for anomaly assessment, provenance tracing and trustworthy operation.
  arXiv  Detail & Related papers  (2026-05-14T05:11:09Z)
• Breaking 5G on The Lower Layer [9.311361097270153]
  We explore lower-layer exploitation in modern 5G.<n>Recent releases have increased the number of lower-layer control messages and procedures.<n>We present two practical attacks and evaluate them in a controlled lab testbed.
  arXiv  Detail & Related papers  (2026-02-10T19:54:32Z)
• Beyond Static Thresholds: Adaptive RRC Signaling Storm Detection with Extreme Value Theory [0.8877220164547092]
  In 5G and beyond networks, the radio communication between a User Equipment (UE) and a base station (gNodeB or gNB) is a critical component of network access and connectivity.<n>These attacks may occur when one or more UEs send a large number of connection requests to the gNB, preventing new UEs from establishing connections.<n>We propose an adaptive threshold-based detection system based on Extreme Value Theory (EVT)
  arXiv  Detail & Related papers  (2025-11-03T09:42:12Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• RRC Signaling Storm Detection in O-RAN [0.0]
  Signaling storms caused by abuse of the Radio Resource Control protocol are a critical threat to 5G availability.<n>We develop a threshold-based detection technique that relies on RRC layer features to distinguish between malicious activity and legitimate high network load conditions.
  arXiv  Detail & Related papers  (2025-04-22T09:32:11Z)
• Seeing is Believing: A Federated Learning Based Prototype to Detect Wireless Injection Attacks [1.8142288667655782]
  Reactive injection attacks are a class of security threats in wireless networks. We implement secret-key based physical-layer signalling methods at the clients. We show that robust ML models can be designed at the base-stations.
  arXiv  Detail & Related papers  (2023-11-11T13:21:24Z)
• Sparsity-Aware Intelligent Massive Random Access Control in Open RAN: A Reinforcement Learning Based Approach [61.74489383629319]
  Massive random access of devices in the emerging Open Radio Access Network (O-RAN) brings great challenge to the access control and management. reinforcement-learning (RL)-assisted scheme of closed-loop access control is proposed to preserve sparsity of access requests. Deep-RL-assisted SAUD is proposed to resolve highly complex environments with continuous and high-dimensional state and action spaces.
  arXiv  Detail & Related papers  (2023-03-05T12:25:49Z)
• Task-Oriented Communications for NextG: End-to-End Deep Learning and AI Security Aspects [78.84264189471936]
  NextG communication systems are beginning to explore shifting this design paradigm to reliably executing a given task such as in task-oriented communications. Wireless signal classification is considered as the task for the NextG Radio Access Network (RAN), where edge devices collect wireless signals for spectrum awareness and communicate with the NextG base station (gNodeB) that needs to identify the signal label. Task-oriented communications is considered by jointly training the transmitter, receiver and classifier functionalities as an encoder-decoder pair for the edge device and the gNodeB.
  arXiv  Detail & Related papers  (2022-12-19T17:54:36Z)
• An anomaly detection approach for backdoored neural networks: face recognition as a case study [77.92020418343022]
  We propose a novel backdoored network detection method based on the principle of anomaly detection. We test our method on a novel dataset of backdoored networks and report detectability results with perfect scores.
  arXiv  Detail & Related papers  (2022-08-22T12:14:13Z)
• Certifiers Make Neural Networks Vulnerable to Availability Attacks [70.69104148250614]
  We show for the first time that fallback strategies can be deliberately triggered by an adversary. In addition to naturally occurring abstains for some inputs and perturbations, the adversary can use training-time attacks to deliberately trigger the fallback. We design two novel availability attacks, which show the practical relevance of these threats.
  arXiv  Detail & Related papers  (2021-08-25T15:49:10Z)
• Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming [97.40955121478716]
  We propose a first-order dual SDP algorithm that requires memory only linear in the total number of network activations. We significantly improve L-inf verified robust accuracy from 1% to 88% and 6% to 40% respectively. We also demonstrate tight verification of a quadratic stability specification for the decoder of a variational autoencoder.
  arXiv  Detail & Related papers  (2020-10-22T12:32:29Z)
• Multi-stage Jamming Attacks Detection using Deep Learning Combined with Kernelized Support Vector Machine in 5G Cloud Radio Access Networks [17.2528983535773]
  This research focuses on deploying a multi-stage machine learning-based intrusion detection (ML-IDS) in 5G C-RAN. It can detect and classify four types of jamming attacks: constant jamming, random jamming, jamming, and reactive jamming. The final classification accuracy of attacks is 94.51% with a 7.84% false negative rate.
  arXiv  Detail & Related papers  (2020-04-13T17:21:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.