# Machine Learning-based Early Attack Detection Using Open RAN Intelligent Controller

arXiv: https://arxiv.org/abs/2302.01864 · HTML: https://mlsanity.com/paper/2302.01864/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Feb 2023.

## Built on by (most cited first, 5 of 5)

- [Modular and Integrated AI Control Framework across Fiber and Wireless Networks for 6G](https://mlsanity.com/paper/2502.15731/) (2025)
- [Rogue Cell: Adversarial Attack and Defense in Untrusted O-RAN Setup Exploiting the Traffic Steering xApp](https://mlsanity.com/paper/2505.01816/) (2025)
- [Interpretable Anomaly-Based DDoS Detection in AI-RAN with XAI and LLMs](https://mlsanity.com/paper/2507.21193/) (2025)
- [Percentile-Based Deep Reinforcement Learning and Reward Based Personalization For Delay Aware RAN Slicing in O-RAN](https://mlsanity.com/paper/2507.18111/) (2025)
- [Explainability Boosted Anomaly Detection Framework for O-RAN based NextG Networks](https://mlsanity.com/paper/2608.14826/) (2026)

## Abstract (arXiv)

We design and demonstrate a method for early detection of Denial-of-Service attacks. The proposed approach takes advantage of the OpenRAN framework to collect measurements from the air interface (for attack detection) and to dynamically control the operation of the Radio Access Network (RAN). For that purpose, we developed our near-Real Time (RT) RAN Intelligent Controller (RIC) interface. We apply and analyze a wide range of Machine Learning algorithms to data traffic analysis that satisfy the accuracy and latency requirements set by the near-RT RIC. Our results show that the proposed framework is able to correctly classify genuine vs. malicious traffic with high accuracy (i.e., 95%) in a realistic testbed environment, allowing us to detect attacks already at the Distributed Unit (DU), before malicious traffic even enters the Centralized Unit (CU).