O-RAN enables a disaggregated baseband stack with programmable functions that communicate over standardized open interfaces. The same openness that enables multi-vendor composition also expands the attack surface across logically decoupled tiers that make up the compute continuum. Among these threats, Denial-of-Service and performance-degradation attacks, which account for the majority of catalogued O-RAN threats, are particularly difficult to detect. Traditional Time-Series Anomaly Detection (TSAD) methods fail in this new regime where labelled baselines are scarce, threats evolve faster than detectors can be retrained, and the high-dimensional multivariate telemetry overwhelms monolithic inference models. To address these challenges, we present DAST, a zero-shot multi-agent framework for cross-interface anomaly detection in O-RAN that chains a three-stage VLM $\rightarrow$ LLM $\rightarrow$ VLM pipeline. DAST converts multivariate KPI streams into visual representations, scores textual per-interface descriptions against O-RAN domain knowledge, and verifies suspects on high-resolution heatmaps to output the problematic interfaces, the anomalous time intervals, an indicative O-RAN WG11-aligned operational impact rating and the decision rationale. We evaluate DAST on real network traces collected from an O-RAN testbed under representative performance degradation scenarios, achieving 0.910 F1-Score and 0.843 Accuracy, outperforming state-of-the-art TSAD baselines.

翻译：O-RAN实现了可编程功能模块通过标准化开放接口通信的分布式基带协议栈。这种支持多厂商协作的开放性，同时扩展了计算连续体中逻辑解耦各层级间的攻击面。在这些威胁中，占已编录O-RAN威胁多数的拒绝服务攻击与性能降级攻击尤为难以检测。传统时间序列异常检测（TSAD）方法在此新场景中失效：标记基线稀缺、威胁演进速度超过检测器重训练周期、高维多元遥测数据令单一推理模型不堪重负。为解决这些挑战，我们提出DAST——一种面向O-RAN跨接口异常检测的零样本多智能体框架，该框架串联三阶段VLM→LLM→VLM流水线。DAST将多元KPI流转换为可视化表征，基于O-RAN领域知识对各接口文本描述进行评分，并通过高分辨率热图验证可疑项，最终输出问题接口、异常时间区间、符合O-RAN WG11标准的运行影响评估等级及其决策依据。我们在典型性能降级场景下，基于O-RAN测试平台采集的真实网络踪迹对DAST进行评估，取得0.910的F1分数与0.843的准确率，性能超越当前最优的TSAD基线方法。