5G and beyond cellular systems embrace the disaggregation of Radio Access Network (RAN) components, exemplified by the evolution of the fronthaul (FH) connection between cellular baseband and radio unit equipment. Crucially, synchronization over the FH is pivotal for reliable 5G services. In recent years, there has been a push to move these links to an Ethernet-based packet network topology, leveraging existing standards and ongoing research for Time-Sensitive Networking (TSN). However, TSN standards, such as Precision Time Protocol (PTP), focus on performance with little to no concern for security. This increases the exposure of the open FH to security risks. Attacks targeting synchronization mechanisms pose significant threats, potentially disrupting 5G networks and impairing connectivity. In this article, we demonstrate the impact of successful spoofing and replay attacks against PTP synchronization. We show how a spoofing attack is able to cause a production-ready O-RAN and 5G-compliant private cellular base station to catastrophically fail within 2 seconds of the attack, necessitating manual intervention to restore full network operations. To counter this, we design a Machine Learning (ML)-based monitoring solution capable of detecting various malicious attacks with over 97.5% accuracy.

5G and beyond cellular networks promise remarkable advancements in bandwidth, latency, and connectivity. The emergence of Open Radio Access Network (O-RAN) represents a pivotal direction for the evolution of cellular networks, inherently supporting machine learning (ML) for network operation control. Within this framework, RAN Intelligence Controllers (RICs) from one provider can employ ML models developed by third-party vendors through the acquisition of key performance indicators (KPIs) from geographically distant base stations or user equipment (UE). Yet, the development of ML models hinges on the availability of realistic and robust datasets. In this study, we embark on a two-fold journey. First, we collect a comprehensive 5G dataset, harnessing real-world cell phones across diverse applications, locations, and mobility scenarios. Next, we replicate this traffic within a full-stack srsRAN-based O-RAN framework on Colosseum, the world's largest radio frequency (RF) emulator. This process yields a robust and O-RAN compliant KPI dataset mirroring real-world conditions. We illustrate how such a dataset can fuel the training of ML models and facilitate the deployment of xApps for traffic slice classification by introducing a CNN based classifier that achieves accuracy > 95% offline and 92% online. To accelerate research in this domain, we provide open-source access to our toolchain and supplementary utilities, empowering the broader research community to expedite the creation of realistic and O-RAN compliant datasets.

Open Radio Access Network (O-RAN) is positioned to play a pivotal role in shaping the future of telecommunications networks through open interfaces and virtualization, allowing interoperability between different vendors. As a key departure from single-operator managed RAN, a remote RAN intelligence controller (RIC) queries the gNB for the Key Performance Indicators (KPIs) that are required for making RAN control decisions, often leveraging advanced machine learning (ML) models. However, this repeated querying increases control traffic overhead on the so called E2 interface connecting the gNB to the RIC. To address this challenge, we utilize a method from Explainable Artificial Intelligence (XAI), specifically SHapley Additive exPlanations (SHAP), which quantifies the contribution of each requested KPI to a model's prediction. Furthermore, we explore two different methods of choosing the most discriminative KPIs influencing model's performance, so that a smaller subset of KPIs may be queried, thus lowering the overhead on the E2 interface. Our analysis reveals that a model trained for the task of traffic classification using as input only the fraction of the top contributing KPIs identified by SHAP reduces control traffic overhead by up to 33% with only 7% reduction in ML classification accuracy.

Spectrum sharing allows different protocols of the same standard (e.g., 802.11 family) or different standards (e.g., LTE and DVB) to coexist in overlapping frequency bands. As this paradigm continues to spread, wireless systems must also evolve to identify active transmitters and unauthorized waveforms in real time under intentional distortion of preambles, extremely low signal-to-noise ratios and challenging channel conditions. We overcome limitations of correlation-based preamble matching methods in such conditions through the design of T-PRIME: a Transformer-based machine learning approach. T-PRIME learns the structural design of transmitted frames through its attention mechanism, looking at sequence patterns that go beyond the preamble alone. The paper makes three contributions: First, it compares Transformer models and demonstrates their superiority over traditional methods and state-of-the-art neural networks. Second, it rigorously analyzes T-PRIME’s real-time feasibility on DeepWave’s AIR-T platform. Third, it utilizes an extensive 66 GB dataset of over-the-air (OTA) WiFi transmissions for training, which is released along with the code for community use. Results reveal nearly perfect (i.e. > 98%) classification accuracy under simulated scenarios, showing 100% detection improvement over legacy methods in low SNR ranges, 97% classification accuracy for OTA single-protocol transmissions and up to 75% double-protocol classification accuracy in interference scenarios.

The next generation of cellular networks will be characterized by openness, intelligence, virtualization, and distributed computing. The Open Radio Access Network (Open RAN) framework represents a significant leap toward realizing these ideals, with prototype deployments taking place in both academic and industrial domains. While it holds the potential to disrupt the established vendor lock-ins, Open RAN's disaggregated nature raises critical security concerns. Safeguarding data and securing interfaces must be integral to Open RAN's design, demanding meticulous analysis of cost/benefit tradeoffs. In this paper, we embark on the first comprehensive investigation into the impact of encryption on two pivotal Open RAN interfaces: the E2 interface, connecting the base station with a near-real-time RAN Intelligent Controller, and the Open Fronthaul, connecting the Radio Unit to the Distributed Unit. Our study leverages a full-stack O-RAN ALLIANCE compliant implementation within the Colosseum network emulator and a production-ready Open RAN and 5G-compliant private cellular network. This research contributes quantitative insights into the latency introduced and throughput reduction stemming from using various encryption protocols. Furthermore, we present four fundamental principles for constructing security by design within Open RAN systems, offering a roadmap for navigating the intricate landscape of Open RAN security.

A promising vision for the emerging next generation of cellular networks is one that embraces openness, intelligence, virtualization, and distributed computing. The Open Radio Access Network (O-RAN) framework is making significant strides toward these goals and is already seeing prototype deployments in academia and industry. While there is general consensus that this technology may disrupt the status quo by eliminating vendor lock-ins, there are serious questions about the security implications in such dis-aggregated networks. Indeed, securing data and controlling interfaces must be a core consideration in the design of O-RAN and cost/benefit tradeoffs need to be rigorously analyzed, given the short time-scales of wireless operation. In this paper, we undertake the first systematic study on the impact of encryption on a critical O-RAN interface (called ‘E2’) connecting the base station to a near-real time radio intelligence controller using an implementation on the Colosseum radio frequency (RF) emulator. The contributions of this paper include quantitative measurements of added latency and CPU utilization due to encryption on the E2 interface that could impact data acquisition and machine learning models. In our experiments we found encryption adds$\leq 50\mu s$of delay and CPU utilization limits throughput to approximately 500 Mbps. We also include a theoretical model to extend this study to other O-RAN implementations beyond the emulation environments of the Colosseum.

REPROOF analytically and experimentally quantifies a Jam Resistant BBC based Uncoordinated Frequency Division Multiplexing (FDM) system that does not require any shared secret.