We design and demonstrate a method for early detection of Denial-of-Service attacks. The proposed approach takes advantage of the OpenRAN framework to collect measurements from the air interface (for attack detection) and to dynamically control the operation of the Radio Access Network (RAN). For that purpose, we developed our near-Real Time (RT) RAN Intelligent Controller (RIC) interface. We apply and analyze a wide range of Machine Learning algorithms to data traffic analysis that satisfy the accuracy and latency requirements set by the near-RT RIC. Our results show that the proposed framework is able to correctly classify genuine vs. malicious traffic with high accuracy (i.e., 95%) in a realistic testbed environment, allowing us to detect attacks already at the Distributed Unit (DU), before malicious traffic even enters the Centralized Unit (CU).

翻译：我们设计并验证了一种用于早期检测拒绝服务攻击的方法。该方法利用OpenRAN框架从空中接口采集测量数据（用于攻击检测），并动态控制无线接入网（RAN）的运行。为此，我们开发了近实时（RT）RAN智能控制器（RIC）接口。针对数据流量分析，我们应用并评估了多种机器学习算法，这些算法能够满足近实时RIC对精度和延迟的要求。实验结果表明，在真实测试环境中，该框架能够以高准确率（即95%）正确分类合法流量与恶意流量，从而在恶意流量进入集中单元（CU）之前，即可在分布式单元（DU）层面实现对攻击的检测。