5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information (long version)

• URL: http://arxiv.org/abs/2609.07367v1
• Date: Mon, 07 Sep 2026 11:39:52 GMT
• Title: 5GDescrambler: Locating, Descrambling, and Decoding 5G Scheduling Information (long version)
• Abstract summary: We present a novel technique to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline.<n>We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors.
• Score: 4.294205370255953
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Tracking users in 5G NR has recently been successfully demonstrated by exploiting various side-channels. This allows for identification of individuals, classification of user activity in real time as well as tracking by fingerprinting, affecting billions of users with a 5G subscription and companies with private 5G deployments. However, previous work relies on weak operator configurations that leak networking parameters--either the radio network temporary identifier (RNTI) or scrambling factor ($N_{ID}$) during handshake--or to inefficiently brute-force Downlink Control Information (DCI). In this paper we present a novel technique exploiting algebraic structure to reverse DCI scrambling, fully integrated into an open-source end-to-end binary DCI sniffing pipeline. It provides enabling input for subsequent attacks like live tracking of users and supports automatic detection of control channel configurations used. We demonstrate the robustness and performance of our approach with measurement campaigns against deployments of srsRAN, OpenAirInterface5G, and two commercial vendors. It reaches block error rates of less than $1\%$ at SNRs below expected values for efficient communication, while performing significantly faster on a reference sample than a previously suggested passive technique brute-forcing the required parameters. In addition, it is entirely passive and does not rely on any side-channel leakage.

Related papers

• Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning [78.29352305480285]
  In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds.<n>This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement.
  arXiv  Detail & Related papers  (2026-08-22T18:38:39Z)
• DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR [1.9336815376402718]
  5G systems are vulnerable to smart jamming attacks that can propagate to applications running on top of these networks.<n>We present DoSQ, a protocol-aware attack that decodes per-slot DCI to inject interference onto the victim UE's Physical Resource Blocks.<n>We also propose an SSB frequency-time-hopping countermeasure that increases the attacker's resynchronization cost.
  arXiv  Detail & Related papers  (2026-07-17T16:37:36Z)
• WISV: Wireless-Informed Semantic Verification for Distributed Speculative Decoding in Device-Edge LLM Inference [56.297697169678095]
  WISV (Wireless-Informed Semantic Verification) is a novel distributed speculative decoding framework.<n>We show that WISV achieves up to a 60.8% increase in accepted length, a 37.3% reduction in interaction rounds, and a 31.4% improvement in end-to-end latency.<n>We validate WISV on a hardware testbed comprising an NVIDIA Jetson AGX Orin and an A40-equipped server.
  arXiv  Detail & Related papers  (2026-04-20T01:29:56Z)
• Tracing the Chain: Deep Learning for Stepping-Stone Intrusion Detection [7.981257687111937]
  Stepping-stone intrusions (SSIs) are a prevalent network evasion technique.<n>Effective SSI detection requires correlating the incoming and outgoing flows at each relay host at extremely low false positive rates.<n> ESPRESSO is a flow correlation model combining a transformer-based feature extraction network, time-aligned multi-channel interval features, and online triplet metric learning.
  arXiv  Detail & Related papers  (2026-04-09T22:26:52Z)
• Machine Learning-Driven Anomaly Detection for 5G O-RAN Performance Metrics [0.8119699312788383]
  We propose two actionable anomaly detection algorithms tailored for real-world deployment.<n>The first algorithm identifies user equipment (UE) at risk of severe throughput degradation by analyzing key performance indicators.<n>The second algorithm evaluates neighbor cell radio coverage quality, filtering out cells with anomalous signal strength or interference levels.
  arXiv  Detail & Related papers  (2025-09-03T13:18:41Z)
• Grimm: A Plug-and-Play Perturbation Rectifier for Graph Neural Networks Defending against Poisoning Attacks [53.972077392749185]
  Recent studies have revealed the vulnerability of graph neural networks (GNNs) to adversarial poisoning attacks on node classification tasks.<n>Here we introduce Grimm, the first plug-and-play defense model.
  arXiv  Detail & Related papers  (2024-12-11T17:17:02Z)
• Scalable and Robust Mobile Activity Fingerprinting via Over-the-Air Control Channel in 5G Networks [0.15346678870160887]
  We show that less than 10% of Physical Downlink Control Channel (PDCCH) messages could be decoded using sniffers. This privacy attack exposes the number of active communication channels and reveals the mobile applications and their usage time. We propose an efficient deep learning-based mobile traffic classification method that eliminates the need for manual feature extraction.
  arXiv  Detail & Related papers  (2024-09-19T08:49:40Z)
• Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience [50.460555688927826]
  We propose the Graph Agent Network (GAgN) to address the vulnerabilities of graph neural networks (GNNs)<n>GAgN is a graph-structured agent network in which each node is designed as an 1-hop-view agent.<n>Agents' limited view prevents malicious messages from propagating globally in GAgN, thereby resisting global-optimization-based secondary attacks.
  arXiv  Detail & Related papers  (2023-06-12T07:27:31Z)
• Deep Attention Recognition for Attack Identification in 5G UAV scenarios: Novel Architecture and End-to-End Evaluation [3.3253720226707992]
  Despite the robust security features inherent in the 5G framework, attackers will still discover ways to disrupt 5G unmanned aerial vehicle (UAV) operations. We propose Deep Attention Recognition (DAtR) as a solution to identify attacks based on a small deep network embedded in authenticated UAVs.
  arXiv  Detail & Related papers  (2023-03-03T17:10:35Z)
• Channel-wise Gated Res2Net: Towards Robust Detection of Synthetic Speech Attacks [67.7648985513978]
  Existing approaches for anti-spoofing in automatic speaker verification (ASV) still lack generalizability to unseen attacks. We present a novel, channel-wise gated Res2Net (CG-Res2Net), which modifies Res2Net to enable a channel-wise gating mechanism.
  arXiv  Detail & Related papers  (2021-07-19T12:27:40Z)
• WNARS: WFST based Non-autoregressive Streaming End-to-End Speech Recognition [59.975078145303605]
  We propose a novel framework, namely WNARS, using hybrid CTC-attention AED models and weighted finite-state transducers. On the AISHELL-1 task, our WNARS achieves a character error rate of 5.22% with 640ms latency, to the best of our knowledge, which is the state-of-the-art performance for online ASR.
  arXiv  Detail & Related papers  (2021-04-08T07:56:03Z)
• Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming [97.40955121478716]
  We propose a first-order dual SDP algorithm that requires memory only linear in the total number of network activations. We significantly improve L-inf verified robust accuracy from 1% to 88% and 6% to 40% respectively. We also demonstrate tight verification of a quadratic stability specification for the decoder of a variational autoencoder.
  arXiv  Detail & Related papers  (2020-10-22T12:32:29Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.