5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service

5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service

Speakers: Haohuang Wen

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=kDJsOLx79r0

Overview

In the rapidly evolving landscape of 5G mobile networks, the transition to Open Radio Access Network (O-RAN) architecture presents both unprecedented opportunities and significant security challenges. Traditional cellular networks, with their closed and proprietary infrastructures, have long been a black box for security researchers. However, 5G's shift towards an open, software-defined, and interoperable paradigm allows for the integration of security-focused services directly into the network fabric. It is within this context that Haohuang Wen introduced 5G-SPECTOR, a groundbreaking framework designed to detect Layer-3 cellular attacks within these emerging O-RAN environments.

5G-SPECTOR addresses a critical gap identified by the mobile security community: the persistent vulnerability of link and session-establishment protocols to exploits that disrupt, spoof, or flood Layer-3 messages. Many of these vulnerabilities, often leveraging software-defined radios (SDRs), continue to impact 5G. As the first comprehensive O-RAN-resident framework for this purpose, 5G-SPECTOR empowers network experts to program sophisticated exploit detection logic directly into an xApp, transforming it into an intelligent intrusion detection system (IDS). The framework is built on three core design principles: granularity for fine-grained security analysis, extensibility for adapting to evolving threats, and efficiency for near real-time processing of high-volume cellular traffic.

To achieve these ambitious goals, 5G-SPECTOR introduces two novel components: MOBIFLOW, a security audit stream that provides fine-grained cellular network telemetry, and MOBIEXPERT, a programmable control-plane xApp. Together, these components enable a proactive and adaptable defense mechanism against a wide spectrum of Layer-3 protocol exploits, marking a significant advancement in securing the future of 5G.

Background

▶ Watch: Introducing 5G-SPECTOR: detecting Layer-3 cellular attacks (0:00)

To appreciate the necessity and innovation of 5G-SPECTOR, it is crucial to understand the fundamental procedures of 5G cellular networks and the architectural paradigm shift introduced by O-RAN. A typical 5G network involves three key entities: the User Equipment (UE) (e.g., a smartphone), the gNodeB (the 5G base station within the Radio Access Network, or RAN), and the Core Network (handling functions like authentication and key agreement). Before a UE can transmit data, it must undergo several control-plane procedures to attach to a gNodeB and register with the Core Network.

These procedures include Cell Selection and PRACH, where the UE decodes System Information Block (SIB) messages to select a gNodeB and then initiates the Physical Random Access Channel (PRACH) for uplink synchronization, receiving a Radio Network Temporary Identifier (RNTI). Next is the Radio Resource Control (RRC) procedure, starting with a Connection Request from the UE, followed by a Connection Setup from the gNodeB, and completing with a Connection Setup Complete message from the UE. Finally, the Non-Access Stratum (NAS) procedure occurs over the established RRC connection, involving messages between the UE and the Access and Mobility Management Function (AMF) in the 5G Core (5GC) or Mobility Management Entity (MME) in the Evolved Packet Core (EPC). This culminates in an Attach or Registration Complete message, enabling user data transmission. Critically, many of these initial control messages, particularly in the RRC and NAS layers, are transmitted without encryption or integrity protection, leaving them vulnerable to Layer-3 attacks.

The O-RAN architecture, inspired by Software-Defined Networking (SDN) principles, disaggregates the RAN control plane from its data plane. The O-RAN Data Plane breaks down the monolithic RAN into logical nodes: the Radio Unit (RU) for Layer-1 physical signals, the Distributed Unit (DU) for Layer-2 functions (MAC, RLC), and the Central Unit (CU) for Layer-3 control protocols (RRC). The CU is further divided into CU-C for control-plane traffic and CU-U for user-plane traffic, connecting to the Core Network via standard interfaces like F1. The O-RAN Control Plane centralizes control logic in the RAN Intelligent Controller (RIC), which manages RAN nodes (CUs and DUs) via the E2 interface. Custom application-layer services, known as xApps, are deployed as plug-n-play software on the RIC, using E2 Service Models (E2SMs) to define communication with RAN nodes. RICs are categorized by latency: near-real-time RICs (nRT-RICs) for control loops within 10ms to 1000ms, and non-real-time RICs for tasks over 1s latency. 5G-SPECTOR specifically operates within the nRT-RIC to ensure timely attack detection.

The work is grounded in a specific threat model. Adversaries are assumed to be capable of compromising UE and RAN availability, confidentiality, and integrity by manipulating unprotected NAS and RRC messages over the radio frequency channel. This includes malicious UEs, and Man-in-the-Middle (MiTM) attacks through signal injection. The focus is on Layer-3 attack surfaces, explicitly excluding passive attacks (undetectable by RAN-based IDS) and Fake Base Station (FBS) attacks, which have been extensively addressed in prior research. A key assumption is that the O-RAN control plane, core network, and all reporting RAN nodes are trusted. Adversaries are categorized into three classes:

1. Adversarial UE: Uses a COTS SDR and open-source cellular software to launch availability attacks (e.g., DoS against a BS by flooding RRC Connection Requests, or DoS against a UE by replaying its identity).
2. MiTM Attacker: Impersonates both a legitimate BS and a legitimate UE using two SDRs to replay or modify unprotected messages.
3. MiTM Signal Injector: A stealthier MiTM attack where an SDR injects malicious signals with slightly higher strength to overshadow legitimate traffic, enabling privacy and availability attacks (e.g., DoS, IMSI extraction).

5G-SPECTOR addresses three critical design goals:

• G1. Granularity: Requires fine-grained telemetry for security analysis. Existing O-RAN E2SMs (like KPM) are too coarse, and raw packet-level telemetry is too costly for high-volume cellular traffic.
• G2. Extensibility: Must adapt to evolving cellular attacks. Learning-based frameworks often lack sufficient adversary training samples, and static IDS frameworks are rigid. A flexible, rule-based expert system with a decoupled architecture and low redeployment cost is desired.
• G3. Efficiency: Must operate within nRT-RIC requirements, detecting and reporting attacks in near real-time. This necessitates processing large message volumes with low latency and an efficient rule inference engine.

Key Findings

▶ Watch: Overview of 5G cellular network procedures (RRC, NAS) (2:00)

5G-SPECTOR represents a significant advancement in securing 5G networks, delivering several key findings and contributions:

• First O-RAN-Resident Layer-3 Attack Detection Framework: 5G-SPECTOR is the pioneering framework designed specifically for detecting Layer-3 cellular attacks within the O-RAN architecture, leveraging its open and programmable nature.
• Novel Telemetry and Programmable xApp: The framework introduces MOBIFLOW, a fine-grained security audit stream inspired by NetFlow, providing rich, stateful, and global statistics essential for security analysis. Complementing this is MOBIEXPERT, a programmable xApp built on the P-BEST production rule language, enabling network operators to define custom intrusion detection logic.
• High Accuracy and Extensibility: In evaluations, 5G-SPECTOR successfully detected all 7 known and 11 unknown Layer-3 cellular attacks (totaling 18 distinct attack instances) in real-time. The system achieved a perfect zero false negative rate, demonstrating its effectiveness and its extensibility to novel attack variants through adaptable rule sets.
• Scalability and Low False Alarm Rate: When tested with 31 real-world cellular traces comprising 118,145 raw packets (converted to 26,790 MOBIFLOW records), 5G-SPECTOR generated only 8 warning events (related to insecure ciphering practices like EEA0 and EIA1) and zero attack events. This translates to an average of only one warning per 374 UE sessions, confirming its scalability to practical scenarios with a remarkably low false alarm rate.
• Practical Over-the-Air (OTA) Detection: The framework's practicality was validated through the reproduction of BTS resource depletion and blind DoS OTA attacks using physical Software-Defined Radios (SDRs) and a COTS Pixel 5 victim UE. 5G-SPECTOR accurately detected these attacks, confirming its capability to identify Layer-3 threats in a real cellular network environment.
• Effective Performance with Low Overhead: 5G-SPECTOR demonstrated robust system performance, achieving approximately 2700 MOBIFLOW packets per second throughput on the RIC machine. Detection latency ranged from 140ms for 1 UE to 280ms for 3 UEs. Crucially, it introduced an average of only 10MB memory overhead on the RAN (4% of total) and 80MB on the RIC (20% of total). CPU overhead was minimal, averaging 1.4% on the RIC and decreasing from 1.8% to 0.5% on the RAN with increasing UEs.
• Efficient Memory Management: The implemented Garbage Collection (GC) mechanism proved highly effective, reducing the number of active ptype instances by 200x in worst-case scenarios, significantly mitigating memory consumption and ensuring sustained efficiency.

These findings collectively establish 5G-SPECTOR as a robust, efficient, and highly capable solution for enhancing the security posture of modern 5G O-RAN deployments.

Technical Deep Dive

▶ Watch: Explaining the O-RAN architecture and RIC xApps (3:00)

5G-SPECTOR's architecture is meticulously designed, decomposing into a control layer and an application layer, each providing specialized services for robust attack detection.

The Control Layer forms the foundation, providing essential telemetry services to xApps while adhering to O-RAN protocols. It comprises two pivotal components: SECSM and MOBIFLOW.

SECSM (Security Module) is an O-RAN-compliant security module specifically engineered to supply security-focused xApps with the necessary data-plane telemetry for real-time security analyses across the mobile network. It integrates several agents that function as plugins to extract telemetry from both the RAN data and control planes. SECSM defines an E2 Service Model (E2SM) specification in ASN.1 for communication protocols, particularly for indication packet formats. SECSM provides two primary services:

1. Registration Management: E2 nodes (CUs and DUs) and xApps must register with the nRT-RIC. An E2 node initiates an E2 Setup Request to the RIC, conveying its meta-information, capabilities, supported E2SM IDs, PLMN IDs, and event trigger/report styles (e.g., periodic reports based on time intervals). Upon successful setup, the RIC sends an E2 Setup Response. After deployment, an xApp subscribes to E2 nodes of interest via a RIC Subscription Request, selecting appropriate event triggers and report styles. SECSM primarily utilizes E2's Report operation for telemetry collection.
2. Telemetry Collection and Reporting: This service is managed by a SECSM agent deployed on the CUs and DUs. Designed as an independent, vendor-agnostic plugin, this agent runs in parallel with normal CU and DU processes. It instruments the standardized F1 Application Protocol (F1AP) interfaces, defined in 3GPP TS 38.473, which manage basic procedures such as UE context setup and RRC message relay. The agent collects telemetry at a defined granularity period (e.g., 100ms) and aggregates it into an indication message. It maintains a telemetry buffer for each subscribed UE, only reporting when a specific UE's state or control traffic has been updated. For each reported UE, its measurement elements, defined in the SECSM specification, are encoded into an indication message. For RRC messages, the agent checks for a NAS payload; if present, it extracts the NAS payload's discriminator and message ID for encoding. Otherwise, it uses RRC channel information, direction, and message ID. A single header bit distinguishes RRC and NAS messages. This indicationMsg is then ASN.1 encoded into an E2AP packet and delivered to the nRT-RIC.

MOBIFLOW (Security Audit Stream), inspired by NetFlow in TCP/IP networks, addresses the limitations of F1AP telemetry, which, while useful, lacks the fine-grained, stateful, and global statistics crucial for comprehensive security analysis. Another SECSM agent at the nRT-RIC converts the reported telemetry into fine-grained MOBIFLOW stream records. This conversion involves additional procedures like state transformation and statistics aggregation, as MOBIFLOW generation is deliberately not performed on the latency-sensitive O-RAN data plane. MOBIFLOW records are categorized into two types:

• UE-centric MobiFlow: Tracks temporary identifiers (e.g., C-RNTI, S-TMSI) and permanent ones (IMEI, IMSI/SUCI). It captures fine-grained UE state transitions at the packet level for RRC and NAS protocols and records timers for RRC/NAS session start and end.
• RAN-centric MobiFlow: Provides real-time aggregated statistics for the RAN, including physical RAN identifiers (MCC, MNC), RAN states (connected/idle UE counts, max capacity), and timers for RAN lifecycle tracking. The generation process infers security states (e.g., whether a UE has completed security mode procedures), records timers (e.g., RRC_CONNECTED or RRC_INACTIVE timers), and aggregates statistics (e.g., active UE counter), ensuring MOBIFLOW provides the necessary context for effective attack detection.

Moving to the App Layer, MOBIEXPERT is the xApp specifically designed for attack detection. MOBIEXPERT prioritizes programmability, allowing network operators to define intrusion detection logic, and flexibility, operating as a lightweight plug-n-play xApp. It leverages the telemetry provided by SECSM and MOBIFLOW and is powered by the P-BEST production rule language. MOBIEXPERT's architecture includes four main components:

1. pbcc translator: Converts a P-BEST specification file (e.g., rule.pbest) into a functional C program, translating P-BEST facts and rules into C variables, structures, and functions, which are then linked to the main P-BEST routine during compilation.
2. eXpert Main Routine: A C routine that handles external inputs, constantly reading MOBIFLOW records, inserting them into a fact pool using library APIs (e.g., assert()), and then handing control to the internal inference engine. This engine is a forward-chaining system that iteratively evaluates and activates rules based on asserted facts until the fact pool stabilizes.
3. Garbage Collection Routine (GC): Crucial for memory management, this routine defines rules to prevent unused facts from consuming resources or to remove facts that no longer require evaluation. It provides fine-grained semantic control over fact-purging criteria, often integrating time references for interval-based collection.
4. P-BEST Libraries: A set of static libraries (libpb.a) linked during compilation, providing P-BEST management APIs, such as assert() to insert new facts and engine() to invoke the inference engine.

The P-BEST Production Rule Language itself is designed for both efficiency and usability. It defines facts as pieces of knowledge in a fact pool and rules as user-defined logic to create, modify, or delete facts based on existing ones. A P-BEST rule is formulated as IF antecedents THEN consequences. Key elements include:

• ptype: Users declare data structures as pattern types, which pbcc converts to C structures. A ptype maps to an event or fact, such as a MOBIFLOW record or an attack event. P-BEST allows creating, modifying, and deleting ptype instances using operands like +, /, and -. Facts can also be masked ($) or unmasked ( ) to control repeated evaluation.
• rule: Defined with the rule keyword and uses -> to connect antecedents and consequents. Rules support logical and arithmetic computations and can invoke C functions. They can also be assigned properties like state (enabled/disabled) and rank (priority).

In the prototype, 5G-SPECTOR was instantiated on SD-RAN, programming 758 lines of P-BEST code as IDS rule sets for 7 types of existing Layer-3 exploits. These specifications translated into over 4,000 lines of C code. The rules are categorized into three sets:

1. Abnormal Quantity Rule Set: Detects attacks requiring quantitative reasoning on accumulated events, such as BTS resource depletion. Rules generate anomalous events when counter values exceed adjustable thresholds.
2. Abnormal Message Sequence Rule Set: Detects attacks based on abnormal message sequences, often protocol state-machine bugs, such as MiTM attacks manipulating unprotected messages or unsolicited IdentityResponse messages.
3. Abnormal State Rule Set: Detects abnormal state parameters, like null ciphering or integrity attacks that trigger a UE into limited service mode without security protection.

Two illustrative examples highlight the rule-based detection:

• Detecting BTS Resource Depletion Attacks: This attack, applicable to 5G, involves a malicious UE flooding a target BS with fabricated RRC ConnectionRequest messages, causing a DoS. The fabricated connections are short-lived, released after the T3460 timer expires awaiting a NAS AuthenticationResponse. P-BEST rules define transient UEs (t_ue) and maintain counters (cnt) per BS. Rules like bts_depletion_first_transient_ue and bts_depletion_add_transient_ue detect and count these ephemeral connections based on their RRC connection period. bts_depletion_generate_event triggers an alert if cnt exceeds a UE_THRESHOLD. A crucial GC rule, bts_depletion_release_transient_ue, decrements the counter and releases t_ue instances when their timers expire, preventing false alarms.
• Detecting Blind DoS Attacks: This attack targets a victim UE by replaying its S-TMSI during an RRC connection, causing the BS to delete the victim's RRC security context. The blind_dos_detect rule checks for two UE sessions (uel, ue2) on the same BS in the RRC_CONNECTED state, where ue2's connection starts after uel's, and critically, ue2 replays uel's S-TMSI. If all conditions are met, a Blind DoS event is reported.

5G-SPECTOR also incorporates different alert levels, distinguishing between critical alerts for confirmed attacks and warnings for insecure but not necessarily malicious practices, such as the use of null ciphering.

Demo / Proof of Concept

▶ Watch: Detailed threat model: adversarial UEs and MiTM attackers (4:00)

The practical viability and effectiveness of 5G-SPECTOR were thoroughly evaluated through a series of experiments, spanning simulated, real-world, and over-the-air (OTA) attack scenarios.

The framework was instantiated using SDRAN-in-a-Box (RiaB), an O-RAN compliant platform. The implementation included the MOBIEXPERT xApp and the custom control plane design (SECSM and MOBIFLOW). For the data plane, the OpenAirInterface (OAI) radio software suite was adopted for the CU, DU, and UE components. The core network utilized ONF's Open Mobile Evolved Core (OMEC). The testbed consisted of a host machine (Ubuntu 18.04, 12 Intel i7-8700 cores, 32GB RAM) running three virtual machines for the core network, RIC, and RAN. The RU front-end was either the OAI nFAPI emulator or a physical USRP B210 SDR.

The evaluation addressed five research questions, with the first three directly demonstrating the system's capabilities:

RQ1: Can 5G-SPECTOR detect known and unknown L3 cellular attacks?

To assess detection capability, two sets of Layer-3 cellular attacks were emulated. The first set comprised 7 known exploits from existing literature, including BTS Resource Depletion and Blind DoS. The second set included 11 unknown attack variants, derived from the known attacks using mutation strategies (e.g., replacing an exploited message with an equivalent one, or moving it to a different RRC/NAS phase). In total, 18 distinct attack instances were tested, each 20 times. Malicious logic was implemented into the OAI emulator; for instance, the BTS resource depletion attack required only 20 lines of C code. For the 11 unknown variants, an additional 90 lines of P-BEST code were developed. The results were conclusive: 5G-SPECTOR successfully detected all 18 attacks, generating accurate and reproducible alerts in real-time, with a zero false negative rate. This demonstrated its high effectiveness and extensibility to previously unseen attack variants.

RQ2: How well does 5G-SPECTOR scale to real-world cellular networks?

To evaluate scalability and false alarm rates in practical scenarios, 31 real-world cellular traces were used: 22 benign traces (BT-1 to BT-22) and 9 abnormal traces (AT-1 to AT-9), collected from COTS UEs and network operators. These traces, varying in duration from seconds to hours, contained 118,145 raw packets, which were converted into 26,790 MOBIFLOW records. When replayed to 5G-SPECTOR, the system produced 8 warning events and zero attack events. Upon investigation, these warnings were attributed to UEs employing insecure null cipher or integrity algorithms (e.g., EEA0 and EIA1), which are considered insecure practices rather than deterministic attacks. 5G-SPECTOR generated a low frequency of alerts (one warning per 374 UE sessions on average) and no false alarms, confirming its scalability and reliability in real-world cellular network conditions.

RQ3: Can 5G-SPECTOR be deployed effectively to detect L3 cellular attacks in practice?

To demonstrate practical deployment, two OTA attacks were reproduced: the BTS resource depletion attack and the blind DoS attack, using the testbed with physical SDRs. A USRP B210 served as the RF front-end, connected to the RAN VM. A COTS Pixel 5 was used as the victim UE, while another USRP B210 acted as the attacker. The Pixel 5 was running an active Zoom session during the experiments. The attacker USRP ran malicious logic within its OAI UE code, manipulating physical layer parameters where necessary (e.g., resetting RRC connection parameters for BTS resource depletion). During the attacks, the victim's Zoom session froze, and its connection was released. 5G-SPECTOR correctly generated alerts with detailed attack information. These results were fully reproducible with no false negatives, definitively confirming 5G-SPECTOR's capability to detect Layer-3 attacks in a real cellular network environment.

The evaluation also covered system performance (RQ4) and overhead (RQ5). For performance, 5G-SPECTOR achieved approximately 2700 MOBIFLOW packets per second throughput at a 200ms granularity period. Average detection latency was 140ms for 1 UE, 160ms for 2 UEs, and 280ms for 3 UEs, indicating a negative impact of increased UE count on latency. MOBIEXPERT efficiently processed over 40,000 MOBIFLOW records and executed nearly 140,000 rules within the first second during stress tests. Regarding overhead, 5G-SPECTOR introduced an average of 10MB memory overhead on the RAN (4% of total) and 80MB on the RIC (20% of total). CPU overhead on the RAN decreased from 1.8% to 0.5% with more UEs, while RIC CPU overhead averaged around 1.4%. The Garbage Collection (GC) mechanism significantly reduced memory consumption, keeping the number of ptypes below a few hundred, a 200x reduction compared to without GC in the worst case.

Defensive Implications

▶ Watch: 5G-SPECTOR's design goals: granularity and extensibility (4:48)

5G-SPECTOR offers critical insights and practical tools for network defenders operating within the burgeoning O-RAN ecosystem. Its design and demonstrated capabilities provide a blueprint for enhancing the security posture of 5G networks against Layer-3 cellular attacks.

Firstly, network operators should recognize the opportunity to deploy 5G-SPECTOR as a robust intrusion detection system (IDS) within the O-RAN nRT-RIC. This leverages the architectural openness of O-RAN, enabling real-time security auditing directly at the network's intelligent control plane. The ability to integrate security as a native xApp, rather than relying on external, out-of-band solutions, is a significant defensive advantage.

Defenders should leverage the MOBIFLOW security audit stream as a primary source of fine-grained telemetry. This stream, with its UE-centric and RAN-centric records, provides the granular, stateful, and global statistics necessary to audit control plane activities effectively. By understanding the specific identifiers (C-RNTI, S-TMSI, IMEI, IMSI/SUCI), state transitions, and aggregated RAN statistics provided by MOBIFLOW, security teams can gain unprecedented visibility into potential anomalies.

The programmable nature of MOBIEXPERT and the P-BEST production rule language empowers network experts to define custom detection logic. This is crucial for adapting to both known and emergent Layer-3 attacks without requiring extensive software redeployment. Defenders should focus on developing P-BEST rule sets categorized by:

• Abnormal Quantity: To detect attacks involving unusual volumes of events, such as BTS resource depletion caused by a flood of RRC Connection Requests. Threshold-based rules can effectively identify such volumetric anomalies.
• Abnormal Message Sequence: To identify protocol state machine violations or unexpected message flows, characteristic of MiTM attacks that manipulate unprotected RRC or NAS messages.
• Abnormal State: To flag UEs operating under insecure conditions, such as instances of null ciphering (e.g., EEA0, EIA1) or attacks that bypass integrity protection, forcing a UE into a limited service mode.

Implementing and fine-tuning Garbage Collection (GC) rules within MOBIEXPERT is also a critical defensive measure. This ensures the efficiency and stability of the nRT-RIC by preventing resource exhaustion from accumulated facts, especially during high-volume traffic or sustained attacks.

Furthermore, the system's ability to differentiate between critical alerts (confirmed attacks) and warnings (insecure practices) is valuable. Defenders should not disregard warnings related to insecure ciphering or integrity algorithms, as these indicate potential vulnerabilities that could be exploited, even if not direct attacks themselves. These warnings can prompt policy enforcement or configuration reviews to enhance overall network security.

Finally, 5G-SPECTOR's real-time alerts can serve as a trigger for automated or semi-automated security countermeasures. For instance, integration with triangulation services could pinpoint the physical location of an attacker, while closed-loop security mechanisms could automatically isolate compromised UEs or adjust network policies in response to detected threats. The framework provides the intelligence layer necessary to enable more proactive and adaptive defenses in 5G O-RAN environments.

Key Takeaways

• Pioneering O-RAN IDS: 5G-SPECTOR is the first comprehensive O-RAN-compliant framework specifically designed for detecting Layer-3 cellular attacks, leveraging the open architecture of 5G.
• Fine-Grained Telemetry and Programmable Logic: It introduces MOBIFLOW, a novel security audit stream for granular network telemetry, and MOBIEXPERT, a programmable xApp powered by the P-BEST production rule language, enabling flexible and extensible attack detection.
• Proven Efficacy and Extensibility: The framework successfully detected all 18 tested Layer-3 cellular attacks (7 known, 11 unknown variants) in real-time with zero false negatives, demonstrating high accuracy and adaptability to evolving threats.
• Scalable and Practical for Real-World Deployments: 5G-SPECTOR showed excellent scalability with real-world cellular traces, generating only 8 warnings (for insecure practices) and zero false alarms, and successfully detected Over-the-Air (OTA) attacks using COTS hardware.
• Efficient Operation with Minimal Overhead: The system maintains high performance, processing approximately 2700 MOBIFLOW packets per second with low detection latency (140-280ms) and minimal overhead (average 2% CPU and 100MB memory across RAN/RIC), supported by an effective Garbage Collection (GC) mechanism.
• Empowering Network Operators: 5G-SPECTOR provides network operators with the tools to program custom, extensible, and efficient intrusion detection logic directly into the O-RAN nRT-RIC, significantly enhancing the security posture of 5G networks.

About the Speaker(s)

The presenter of this talk was Haohuang Wen. Based on the provided transcript and metadata, no further biographical details such as title or company affiliation were explicitly mentioned.