💻 computer science

StormShield: Fingerprint-Based Detection and Mitigation of RRC Signaling Storms in O-RAN 5G RANs

This paper presents StormShield, an xApp-based solution for O-RAN 5G networks that utilizes fingerprinting to detect and mitigate Radio Resource Control (RRC) signaling storms with 97.6% accuracy within 106.5 ms, effectively preventing gNB resource exhaustion in real-world over-the-air testbeds.

Original authors: Noemi Giustini, Andrea Lacava, Leonardo Bonati, Stefano Maxenti, Michele Polese, Tommaso Melodia, Francesca Cuomo

Published 2026-05-15

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Noemi Giustini, Andrea Lacava, Leonardo Bonati, Stefano Maxenti, Michele Polese, Tommaso Melodia, Francesca Cuomo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a busy 5G cell tower (called a gNB) as a popular coffee shop. The baristas (the network) are ready to serve customers (your phone), but they have a limited number of cups and a finite amount of time to take orders.

The Problem: The "Fake Order" Storm

In this paper, the authors describe a specific type of cyberattack called an RRC Signaling Storm.

Think of a Malicious User (MUE) not as a real customer, but as a prankster standing in line. Every time the barista calls out, "Who's next?", the prankster shouts, "Me! I want a coffee!" and hands over a fake ID. The barista, being polite, starts preparing a cup and setting aside a spot at the counter for this person.

However, the prankster never actually orders or pays. They just keep shouting "Me!" over and over again with different fake names.

The Result: The baristas get so busy setting aside cups and spots for these fake customers that they run out of resources. Real customers (legitimate phones) trying to buy coffee get ignored and can't get in. The shop is effectively shut down, not because it's too busy with real people, but because the pranksters are hogging the counter space.

The Challenge: Distinguishing Chaos from Crowds

The tricky part is that sometimes the coffee shop is just genuinely busy (a "high-load" scenario). If a hundred real people walk in at once, the baristas are also swamped.

Old defenses were like a bouncer who just counts how many people are shouting. If the number is high, they stop everyone. This causes a lot of false alarms, kicking out real customers just because the shop is popular.
The new problem: The pranksters keep changing their fake names, so the barista can't just write "Bad Guy #1" on a list and ban them.

The Solution: "StormShield"

The authors built a smart security system called StormShield. They installed it in a "Near-Real-Time" control room (part of the O-RAN architecture) that watches the line and makes split-second decisions.

Here is how StormShield works, using simple analogies:

1. The "Fingerprint" (The ID Check)

Instead of just counting heads, StormShield looks at how people are shouting.

Timing Advance (TA): This is like measuring exactly how far away someone is standing from the counter.
Signal Strength (RSSI): This is like measuring how loud their voice is.

If 100 different real customers walk in, they are standing at different distances and have different voice volumes. Their "fingerprints" are all scattered.
But, if one prankster is shouting 50 times in a row, they are standing in the exact same spot with the exact same voice volume every time. Their fingerprints form a tight, dense cluster.

2. The "Smart Clustering" (Spotting the Prankster)

StormShield uses a mathematical tool (called DBSCAN) to look at the crowd.

Scenario A (Real Crowd): The fingerprints are scattered all over the room. StormShield says, "Okay, this is just a busy day. Let the customers in."
Scenario B (The Attack): The system sees a huge, dense blob of fingerprints all coming from the exact same spot. StormShield says, "Aha! One person is shouting 50 times. That's the prankster."

3. The "Bouncer" (Blocking the Attack)

Once StormShield identifies the "blob" of fake orders, it instantly updates the bouncer's list.

It tells the baristas: "If anyone tries to order with this specific distance and voice volume, stop them immediately."
Crucially, this happens before the baristas waste time making the coffee. The fake order is rejected at the door, saving the cups for real customers.
The system is also smart enough to "age" the list. If the prankster stops shouting, the ban eventually expires so that if a real person happens to stand in that same spot later, they aren't unfairly banned forever.

The Testing: Real-World Proof

The authors didn't just simulate this on a computer; they built a real test lab.

They used real 5G equipment (including commercial radio units and software-defined radios).
They created a "prankster" phone that actually shouted fake orders.
They tested it with the prankster standing still and even while the prankster was moving (walking around the room).

The Results:

Accuracy: StormShield correctly identified the prankster 97.6% of the time.
Speed: It caught the attack in about 106 milliseconds (less than a blink of an eye).
Protection: It successfully stopped the prankster from exhausting the barista's resources, allowing real customers to get their coffee even during the attack.

Summary

StormShield is a smart security guard for 5G networks. Instead of just counting how many connection requests come in (which confuses busy days with attacks), it looks at the physical "fingerprint" of the request. If it sees one device frantically trying to connect from the exact same spot over and over, it blocks that specific device instantly, keeping the network open for everyone else.

Technical Summary: StormShield – Fingerprint-Based Detection and Mitigation of RRC Signaling Storms in O-RAN 5G RANs

Problem Statement
While 5G networks offer enhanced capabilities, the control plane remains vulnerable to Denial-of-Service (DoS) attacks, specifically Radio Resource Control (RRC) signaling storms. In this attack vector, a Malicious User Equipment (MUE) repeatedly initiates connection procedures by sending RRC Setup Requests (MSG3) with varying Radio Network Temporary Identifiers (RNTIs) but intentionally omits the final RRC Setup Complete message (MSG5). This behavior forces the Next Generation Node Base (gNB) to allocate control-plane resources and maintain RRC contexts for unauthenticated sessions without completing the handshake. Consequently, the gNB's pool of RRC contexts is exhausted, preventing legitimate User Equipments (UEs) from establishing connections.

Existing defenses face significant limitations:

Differentiation Difficulty: The initial behavior of an attack mimics legitimate high-load network conditions (bursts of connection requests), making rate-based thresholds prone to false alarms.
Identity Evasion: Since MUEs never complete authentication, their temporary identifiers (RNTIs) change with every attempt, rendering per-UE blocking policies ineffective.
Static Assumptions: Prior work often relies on simulations, static setups, or single indicators (like Timing Advance) that fail in dense or indoor environments where spatial parameters overlap.
Lack of Mitigation: Most existing solutions focus solely on detection rather than proactive mitigation.

Methodology
The authors propose StormShield, a detection and mitigation framework implemented as an xApp on an O-RAN Near-Real-Time (near-RT) RAN Intelligent Controller (RIC). The solution leverages the Open RAN architecture's open interfaces to collect fine-grained Key Performance Metrics (KPMs) and enforce control actions without modifying the RAN data plane.

The core logic operates in two stages:

Fingerprint-Based Detection:
- Input: The system monitors RRC message counts (MSG3, MSG4, MSG5) and radio-level fingerprints: Timing Advance (TA) and Received Signal Strength Indicator (RSSI).
- Coarse-Grained Analysis: It calculates completion ratios ( $R_1 = MSG5/MSG3$ and $R_2 = MSG5/MSG4$ ). A high volume of MSG3 combined with low completion ratios triggers a potential attack alert.
- Fine-Grained Clustering: To distinguish attacks from benign high-load scenarios, the system applies the DBSCAN clustering algorithm to the (TA, RSSI) fingerprint history.
  - Attack Scenario: A single MUE repeatedly sending requests from a fixed or slowly moving location generates a dense cluster of similar fingerprints.
  - Benign Scenario: Legitimate high load involves many distinct UEs, resulting in a scattered distribution of fingerprints.
- Decision: If a cluster's density exceeds a threshold ( $T_3$ ), the centroid of that cluster is identified as a malicious fingerprint.
Pre-Authentication Mitigation:
- Blocklist Management: The gNB maintains an adaptive blocklist of malicious fingerprints (centroids).
- Aging Mechanism: Entries include a match counter and a timeout. The timeout increases linearly with repeated matches to reinforce blocking against persistent attackers but expires automatically if no new matches occur, preventing the long-term exclusion of benign UEs that might share similar transient radio conditions.
- Action: When a new connection attempt arrives, the gNB measures its current (TA, RSSI) fingerprint. If it matches a blocked centroid within defined tolerances ( $\epsilon_{TA}, \epsilon_{RSSI}$ ), the connection is rejected immediately, and the RRC context is dropped before resources are fully allocated.

Experimental Setup
The authors validated StormShield on two distinct Over-The-Air (OTA) testbeds using the OpenAirInterface (OAI) 5G protocol stack:

SDR Setup: An USRP X410 Software-Defined Radio (SDR) with an 8.1 functional split.
Commercial RU Setup: A Foxconn Radio Unit (RU) with a 7.2 functional split, connected to an NVIDIA Aerial accelerated gNB.

The testbeds supported various scenarios, including static and mobile attackers, single and multiple concurrent MUEs, and the use of commercial smartphones as legitimate victims. The MUE was emulated by modifying the OAI UE RRC state machine to drop MSG5.

Key Results

Detection Accuracy: StormShield achieved an average detection accuracy of 97.6% across all tested scenarios.
Response Time: The system identified and blocked attacks with an average response time of 106.5 ms from the onset of the attack. This is significantly faster than the time required to deplete gNB resources (which ranged from 312 ms to 326 ms in the absence of mitigation).
Robustness: The solution remained effective with multiple attackers and mobile MUEs.
Collateral Blocking: In static scenarios, the Collateral Blocking Rate (CBR)—where legitimate UEs were mistakenly blocked—was between 17% and 25% depending on the number of attackers and radio setup. In mobile scenarios, the CBR increased slightly to 25%, attributed to the dynamic nature of RSSI and TA values.
Parameter Sensitivity: Fine-tuning experiments demonstrated that the system is sensitive to the clustering radius ( $\epsilon_{RSSI}$ ) and message thresholds ( $T_1, T_2$ ). An optimal configuration (E1) was identified that balanced high true-positive rates with zero false positives and zero collateral blocking in ideal static conditions.

Significance and Claims
The paper claims that StormShield addresses a critical gap in 5G security by moving beyond detection-only or simulation-based approaches to a real-world, pre-authentication mitigation strategy. Its significance lies in:

Feasibility Demonstration: Proving that RRC signaling storms can be reproduced and studied on realistic 5G OTA testbeds with mobility and multiple attackers.
Differentiation Capability: Successfully distinguishing between malicious signaling storms and benign high-load network conditions using a combination of RRC statistics and spatial fingerprints, a challenge where previous threshold-based methods failed.
O-RAN Integration: Demonstrating a closed-loop control mechanism within the O-RAN near-RT RIC that requires no changes to the underlying RAN data plane, utilizing a custom Service Model (SM) for telemetry and control.
Adaptive Mitigation: Introducing an aging mechanism for blocklists that prevents permanent blocking of benign users while maintaining protection against persistent attackers.

The authors conclude that while the system is highly effective, future work will focus on integrating additional hardware-specific features (e.g., I/Q sample analysis) for more robust fingerprinting and expanding the threat model to include stealthier adversaries capable of completing partial authentication.