Cross-Layer Intrusion Detection in 5G O-RAN: Gains and Limits of Fusing Radio Telemetry with Network Flow Records

2026-06-21

AI Summary

This study investigates cross-layer fusion of radio telemetry from the Distributed Unit (DU) and network flow records from the Centralized Unit (CU) in 5G O-RAN architectures to enhance intrusion detection performance. By jointly modeling these two data modalities across seven deep learning architectures—including GRU and Transformer—and employing inference-time separation with multi-random-seed validation, the work systematically evaluates multimodal fusion efficacy. Findings reveal that radio features consistently match or outperform network flow features; fusion yields performance gains only when single-modality detection rates fall below 0.75 and exclusively benefits GRU and Transformer models. Moreover, across all configurations, confusion between DoS and benign traffic remains substantial, with misclassification rates ranging from 27% to 46%, highlighting a fundamental limitation inherent in window-based statistical aggregation.

Abstract

Open RAN disaggregation enables joint analysis of DU radio telemetry and CU-side network-flow records, motivating cross-layer intrusion detection. We evaluate whether fusing these two modalities improves over each individually across seven architectures, using run-disjoint splits over ten seeds on a live 5G O-RAN dataset. Radio features match or outperform network flows on ROC-AUC and run-level detection rate across all architectures. Fusion yields selective ROC-AUC gains but at a one-percent false-positive operating point improves detection rate only for GRU and Transformer, reducing it for the other five models. The benefit is confined to architectures where both single-modality detection rates fall below 0.75. A DoS-to-Benign confusion of 27 to 46 percent persists across all 42 tested configurations of architecture, modality, and window duration, pointing to a limitation in the tested windowed statistical aggregation rather than in model capacity. Code is publicly available.

Problem

• Cross-layer intrusion detection
• 5G O-RAN
• Radio telemetry
• Network flow records
• Fusion

Innovation

• cross-layer intrusion detection
• O-RAN
• radio telemetry
• network flow records
• multimodal fusion