Anomalous state detection in radio access networks: A proof-of-concept

Modern radio access networks (RANs) are both highly complex and potentially vulnerable to unauthorized security setting changes. A RAN is studied in a proof-of-concept experiment to demonstrate that an unauthorized network state is detectable at layers in the RAN architecture away from the source of the state setting. Specifically, encryption state is set at the packet data convergence protocol (PDCP) layer in the Long-Term Evolution (LTE) network model and an anomalous cipher-OFF state is shown to be detectable at the physical layer. Three tranches of experimental data totaling 1,987 runs and each involving 285 measurands were collected and used to construct and demonstrate single-feature, multi-feature, and multi-run encryption state detectors. These detectors show a range of performances with the single-feature detector based on reference signal received quality achieving near-0% false alarms and near-100% true detections. Multi-run averaging detectors show similar low-error performance, even just based on marginally effective detector features. The detectors' performances are studied across the three tranches of experimental data and found by multiple complementary measures to be generalizable provided the testbed protocol is carefully controlled. Essential to these results was an automated, comprehensively instrumented experiment testbed in which measurands were treated as distributions.