Detection of UE Metric Data Poisoning in O-RAN: Automated Risk Analysis and Resilience

The implementation of open radio access network (O-RAN) architecture brings with it new security challenges, owing to the use of machine learning (ML) methods on the near-real-time radio access network (RAN) intelligent controller (Near-RT RIC) and non-real-time RAN intelligent controller (Non-RT RIC). Some of the threats arise from large-scale data poisoning. Considering this, a novel system of security solutions, deployed as xApps and rApps in the O-RAN network, which seeks to address the threat posed by an adversary which targets the network utilising a large botnet of user equipment (UEs) for the purpose of data poisoning is proposed. This security system comprises a UE risk analysis xApp running on the Near-RT RIC, an xApp misbehaviour detection function running on the Near-RT RIC platform, and a resilience management rApp running on the Non-RT RIC. An experiment is presented which illustrates the operation of the risk analysis system's UE classifier and the effects of varying an associated hyperparameter, which re-emphasises careful tuning to optimise the classifier's performance and, consequently, risk analysis accuracy.