Benchmarking Unsupervised Jamming Detection in 5G Open RAN

Sneihil Gopal; Fernando J. Cintron; Richard A. Rouil

cs.AINov 3, 2026

Benchmarking Unsupervised Jamming Detection in 5G Open RAN

Authors: Sneihil Gopal, Fernando J. Cintron, Richard A. Rouil

Organizations: PREP Associate, National Institute of Standards and Technology (NIST), USA · Department of Physics, Georgetown University, USA · National Institute of Standards and Technology (NIST), USA.

Abstract

Radio Frequency (RF) jamming threatens fifth-generation (5G) networks. Open Radio Access Network (Open RAN) telemetry enables jamming detection without dedicated spectrum monitoring equipment, but labeled attack data are rarely available across deployments, motivating unsupervised detectors. Comparing such detectors across algorithmic families, however, remains difficult without ground-truth labels. This paper benchmarks statistical and reconstruction-based unsupervised jamming detectors using a symmetric evaluation interface that combines detection confidence and temporal interval coherence into a detector-independent composite score. We compare a Statistical Ensemble Method (SEM) detector against Vanilla, Long Short-Term Memory (LSTM), and Variational Autoencoder (VAE) baselines on Key Performance Indicator (KPI) telemetry from ten heterogeneous 5G environments with fixed and variable jamming bursts and dynamic jammer gains. Under leave-one-out (LOO) evaluation, SEM achieves a mean composite score of 0.906, compared with 0.688 for the best autoencoder (AE) per fold. Ground-truth validation yields a mean F1-score of 0.918 for SEM, compared with 0.521 for the best AE variant. The composite ranks SEM first in all environments, consistent with F1 rankings. However, in both within-trace and cross-trace evaluation, it fails for detectors that flag far fewer samples than the jamming prevalence, indicating that rankings are reliable only when detection rate matches the expected prevalence.

Figures & tables

Fig. 1 : Overview of the SEM detection pipeline [ 6 ] .

Log	UEs	Duration	ON (s)	Gain (dB)	Samples	Jam (%)
$1$	$3$	$68$ min	$60$	$48$	$12,185$	$56.3$
$2$	$2$	$62$ min	$60$	$48$	$7,467$	$56.4$
$3$	$2$	$43$ min	$60$	$48$	$5,131$	$57.7$
$4$	$1$	$47$ min	$60$	$48$	$2,810$	$59.1$
$5$	$1$	$79$ min	$30$	$48$	$4,749$	$40.8$
$6$	$1$	$15$ min	$60$	$45$	$925$	$58.8$

TABLE I: Dataset summary. Samples are per- UE reports, and Jam is the fraction of labeled reports under jamming.

Fig. 2 : Per-log composite ( $C$ ) and F1 under LOO evaluation.

Group	Results	Median $C_{\text{2-comp}}$	Median F1	Max F1
AE , $r<0.3$	$12$	$0.51$	$0.07$	$0.43$
AE , $r\geq 0.5$	$17$	$0.60$	$0.68$	$0.92$
SEM , $r\in[0.91,1.28]$	$10$	$0.91$	$0.94$	$0.99$

TABLE II: Composite and F1 grouped by the ratio

r

of detection rate to jamming prevalence under LOO evaluation.

Fig. 3 : Proposed SEM deployment in the Open RAN architecture.

Unsupervised Anomaly Detection

Unsupervised anomaly detection finds unusual patterns without labeled examples of faults, attacks, defects, or other rare events.

See all 229 papers

O-RAN-Native Jamming Detection Under Network Heterogeneity
Oct 14, 2026Sneihil Gopal, Fernando J. Cintrón, Richard A. RouilWireless Communications Anomaly Detection
PREP Associate, National Institute of Standards and Technology (NIST), USA · Department of Physics, Georgetown University, USA · National Institute of Standards and Technology (NIST), USA
Explainable and Hardware-Efficient Jamming Detection for 5G Networks Using the Convolutional Tsetlin Machine
Mar 7, 2026Vojtech Halenka, Mohammadreza Amini, Per-Arne Andersen +2Wireless Communications Edge Inference
Center of Artificial Intelligence Research, University of Agder, Grimstad, Norway · School of Electrical Engineering and Computer Science, University of Ottawa, Ottawa, ON, Canada
Toward Resilient 5G Networks: Comparative Analysis of Federated and Centralized Learning for RF Jamming Detection
May 3, 2026Samhita Kuili, Mohammadreza Amini, Burak KantarciWireless Communications Privacy-Preserving ML
School of Electrical Engineering and Computer Science, University of Ottawa, Ottawa, ON, Canada

Oct 14, 2026J/K move · Enter open · S save

O-RAN-Native Jamming Detection Under Network Heterogeneity

Sneihil Gopal, Fernando J. Cintrón, Richard A. Rouil

PREP Associate, National Institute of Standards and Technology (NIST), USA · Department of Physics, Georgetown University, USA · National Institute of Standards and Technology (NIST), USA

Wireless Communications Anomaly Detection Open Radio Access Network

Open paper AskPDF arXiv

Radio-frequency jamming threatens cellular network operations in contested environments. The Open Radio Access Network (O-RAN) architecture exposes per-User Equipment (UE) telemetry through the E2 interface, enabling Key Performance Indicator (KPI)-based jamming detection without proprietary hardware. However, operational deployment demands detection methods that generalize across heterogeneous networks. We propose a Statistical Ensemble Method (SEM) combining adaptive Median Absolute Deviation (MAD)-based baseline detection, count-based anomaly detection, and abrupt change detection through a weighted voting system. SEM operates in two modes: a cold-start mode requiring no labeled data for immediate deployment, and a supervised mode where parameters are refined offline via grid search as labeled data accumulates. We evaluate SEM against five machine learning (ML) classifiers and five deep learning (DL) sequence models using approximately 25 hours of testbed data comprising logs from eight heterogeneous 5G environments, employing both single-environment and multi-environment leave-one-out (LOO) validation. Our analysis indicates that under conditions not encountered during training (distribution shift), learning-based models tend to lose recall and miss jamming events, whereas SEM, even in cold-start mode, maintains detection capabilities at the cost of false alarms. Furthermore, SEM's parameter optimization can be mapped to O-RAN's Non-RT RIC as an rApp for continuous refinement, allowing operators to transition to learning-based alternatives once corpus coverage is sufficient.

Abstract

Unsupervised Anomaly Detection

Explore similar work

O-RAN-Native Jamming Detection Under Network Heterogeneity

Explainable and Hardware-Efficient Jamming Detection for 5G Networks Using the Convolutional Tsetlin Machine

Toward Resilient 5G Networks: Comparative Analysis of Federated and Centralized Learning for RF Jamming Detection