Explainability Boosted Anomaly Detection Framework for O-RAN based NextG Networks
Organizations: Faculty of Electrical and Electronics Engineering, Istanbul Technical University, Istanbul, Turkiye · Communications and Signal Processing Research (HISAR) Lab, TUBITAK BILGEM, Kocaeli, Turkiye
Abstract
The wireless networks have historically faced significant security vulnerabilities, necessitating advanced anomaly detection mechanisms, especially as networks evolve towards 6G and beyond. This study introduces an advanced anomaly detection framework that leverages explainable artificial intelligence to enhance the security of next-generation (NextG) cellular networks. By implementing and evaluating a variety of artificial intelligence models, the framework demonstrates high accuracy and efficient runtime performance in identifying malicious traffic within a realistic Open Radio Access Network (O-RAN) testbed. A key innovation of this work is the integration of post-hoc explainability methods to identify the most critical key performance metrics (KPMs), which enables a significant 80% reduction in dataset complexity without compromising detection accuracy. Additionally, explainability analyses identify several critical attack traffic characteristics, such as protocol type, bandwidth, interval, and duration, to prevent upcoming network attacks. The resulting framework effectively balances computational efficiency, accuracy, and explainability, underscoring its practical applicability for enhancing security in next-generation cellular networks.
Figures & tables
| # | Metric Name | Description | Unit | Usage |
|---|---|---|---|---|
| 1 | ★ DRB.PdcpSduVolumeDL | PDCP SDU volume in the downlink | kb | Monitors the downlink data transmitted at the PDCP layer. |
| 2 | ★ DRB.PdcpSduVolumeUL | PDCP SDU volume in the uplink | kb | Monitors the uplink data transmitted at the PDCP layer. |
| 3 | ★ DRB.RlcSduDelayDL | RLC SDU delay in the downlink | s | Measures latency at the RLC layer in the downlink. |
| 4 | ★ DRB.UEThpDL | UE throughput in the downlink | kbps | Monitors the data rate in the downlink. |
| 5 | ★ DRB.UEThpUL | UE throughput in the uplink | kbps | Monitors the data rate in the uplink. |
| 6 | DRB.UEBufferSizeUL | UE buffer size in the uplink | kb | Indicates the uplink buffer occupancy at the UE. |
| Type | Protocol | BW (Mbps) | Duration (s) |
| Benign Traffic | |||
| Instant Messaging | 80 / UDP | 0.5–1.5 | 85–125 |
| Remote Access | 22 / TCP | 1.5–2.5 | 85–125 |
| Web Browsing | 5222 / TCP | 1.5–2.5 | 85–125 |
| File Transfer | 21 / TCP | 2.5–3.5 | 85–125 |
| Streaming | 1935 / TCP | 2.5–3.5 | 85–125 |
| Features | Method | Train Acc. (%) | Test Acc. (%) | Train Time (s) | Inf. Lat. ( s) | Precision | Recall | F1-Score |
|---|---|---|---|---|---|---|---|---|
| All Features | Decision Tree (DT) | 97.04 | 96.25 | 0.1881 | 1.60 | 0.957 | 0.922 | 0.939 |
| Random Forest (RF) | 97.42 | 97.01 | 0.2132 | 24.70 | 0.973 | 0.930 | 0.951 | |
| K-Nearest Neighbor (KNN) | 94.70 | 90.80 | 0.0027 | 17.70 | 0.861 | 0.842 | 0.852 | |
| Isolation Forest (IF) | 80.95 | — | 0.2416 | 99.00 | 0.709 | 0.679 | 0.694 | |
| Long Short Term Memory (LSTM) | 95.82 | 94.70 | 167.8298 | 25.60 | 0.924 | 0.895 | 0.909 | |
| Significant Features | Decision Tree (DT) | 97.00 | 96.75 | 0.0484 | 0.91 | 0.973 | 0.922 | 0.947 |
| Feature | Method | EWMA Rank |
|---|---|---|
| AttackerUE_DRB.UEThpUl | Both (1/1) | 2 (0.0275) |
| AttackerUE_DRB.PdcpSduVolumeUL | Both (2/2) | 1 (0.0276) |
| AttackerUE_DRB.UEBufferSizeUL | LIME (3) | 8 (0.0245) |
| AttackerUE_RRU.PrbTotDL | SHAP (3) | 9 (0.0235) |
Network Intrusion Detection
Network intrusion detection identifies malicious or abnormal network activity to help protect computers, connected devices, and critical infrastructure.
See all 168 papers