5G and beyond cellular systems embrace the disaggregation of Radio Access Network (RAN) components, exemplified by the evolution of the fronthaul (FH) connection between cellular baseband and radio unit equipment. Crucially, synchronization over the FH is pivotal for reliable 5G services. In recent years, there has been a push to move these links to an Ethernet-based packet network topology, leveraging existing standards and ongoing research for Time-Sensitive Networking (TSN). However, TSN standards, such as Precision Time Protocol (PTP), focus on performance with little to no concern for security. This increases the exposure of the open FH to security risks. Attacks targeting synchronization mechanisms pose significant threats, potentially disrupting 5G networks and impairing connectivity. In this paper, we demonstrate the impact of successful spoofing and replay attacks against PTP synchronization. We show how a spoofing attack is able to cause a production-ready O-RAN and 5G-compliant private cellular base station to catastrophically fail within 2 seconds of the attack, necessitating manual intervention to restore full network operations. To counter this, we design a Machine Learning (ML)-based monitoring solution capable of detecting various malicious attacks with over 97.5% accuracy.

翻译：5G及未来蜂窝系统正采用无线接入网（RAN）组件的解耦架构，其典型体现为蜂窝基带与射频单元设备间前传（FH）连接的演进。至关重要的是，前传上的同步对于可靠的5G服务具有决定性作用。近年来，业界致力于将这些链路迁移至基于以太网的分组网络拓扑，利用现有标准及面向时间敏感网络（TSN）的持续研究成果。然而，TSN标准（如精密时间协议PTP）主要关注性能，几乎未涉及安全性考量，这增加了开放前传面临安全风险的暴露程度。针对同步机制的攻击构成重大威胁，可能导致5G网络中断并损害连接性。本文通过实验展示了针对PTP同步的成功欺骗与重放攻击的影响：我们证明欺骗攻击能在2秒内导致具备生产就绪性的O-RAN与5G合规私有蜂窝基站发生灾难性故障，需人工干预方可恢复完整网络运行。为应对此问题，我们设计了一种基于机器学习（ML）的监测方案，能够以超过97.5%的准确率检测多种恶意攻击。