# From Description to Detection: LLM based Extendable O-RAN Compliant Blind DoS Detection in 5G and Beyond

arXiv: https://arxiv.org/abs/2510.06530 · HTML: https://mlsanity.com/paper/2510.06530/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 47 references that are in the map.
- First posted on arXiv 8 Oct 2025.

## Builds on (most cited first, 16 of 16)

- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [Large Language Models are Zero-Shot Reasoners](https://mlsanity.com/paper/2205.11916/) (2022)
- [A Survey on Evaluation of Large Language Models](https://mlsanity.com/paper/2307.03109/) (2023)
- [AnomalyCLIP: Object-agnostic Prompt Learning for Zero-shot Anomaly Detection](https://mlsanity.com/paper/2310.18961/) (2023)
- [Bad Characters: Imperceptible NLP Attacks](https://mlsanity.com/paper/2106.09898/) (2021)
- [Real-Time Anomaly Detection and Reactive Planning with Large Language Models](https://mlsanity.com/paper/2407.08735/) (2024)
- [Understanding O-RAN: Architecture, Interfaces, Algorithms, Security, and Research Challenges](https://mlsanity.com/paper/2202.01032/) (2022)
- [Large Language Models for Forecasting and Anomaly Detection: A Systematic Literature Review](https://mlsanity.com/paper/2402.10350/) (2024)
- [Understanding Nonlinear Collaboration between Human and AI Agents: A Co-design Framework for Creative Design](https://mlsanity.com/paper/2401.07312/) (2024)
- [Colosseum: Large-Scale Wireless Experimentation Through Hardware-in-the-Loop Network Emulation](https://mlsanity.com/paper/2110.10617/) (2021)
- [Linguistic Intelligence in Large Language Models for Telecommunications](https://mlsanity.com/paper/2402.15818/) (2024)
- [Managing O-RAN Networks: xApp Development from Zero to Hero](https://mlsanity.com/paper/2407.09619/) (2024)
- [AdaptOver: Adaptive Overshadowing Attacks in Cellular Networks](https://mlsanity.com/paper/2106.05039/) (2021)
- [Robust Anomaly Detection in O-RAN: Leveraging LLMs against Data Manipulation Attacks](https://mlsanity.com/paper/2508.08029/) (2025)
- [European 5G Security in the Wild: Reality versus Expectations](https://mlsanity.com/paper/2305.08635/) (2023)
- [Exploiting and Securing ML Solutions in Near-RT RIC: A Perspective of an xApp](https://mlsanity.com/paper/2406.12299/) (2024)

## Built on by (most cited first, 1 of 1)

- [AutoSec-RAN: Specification-Grounded LLM Fine-Tuning for Automated Security Analysis of O-RAN](https://mlsanity.com/paper/2610.15995/) (2026)

## Abstract (arXiv)

The quality and experience of mobile communication have significantly improved with the introduction of 5G, and these improvements are expected to continue beyond the 5G era. However, vulnerabilities in control-plane protocols, such as Radio Resource Control (RRC) and Non-Access Stratum (NAS), pose significant security threats, such as Blind Denial of Service (DoS) attacks. Despite the availability of existing anomaly detection methods that leverage rule-based systems or traditional machine learning methods, these methods have several limitations, including the need for extensive training data, predefined rules, and limited explainability. Addressing these challenges, we propose a novel anomaly detection framework that leverages the capabilities of Large Language Models (LLMs) in zero-shot mode with unordered data and short natural language attack descriptions within the Open Radio Access Network (O-RAN) architecture. We analyse robustness to prompt variation, demonstrate the practicality of automating the attack descriptions and show that detection quality relies on the semantic completeness of the description rather than its phrasing or length. We utilise an RRC/NAS dataset to evaluate the solution and provide an extensive comparison of open-source and proprietary LLM implementations to demonstrate superior performance in attack detection. We further validate the practicality of our framework within O-RAN's real-time constraints, illustrating its potential for detecting other Layer-3 attacks.