Title: ARGOS: Anomaly Recognition and Guarding through O-RAN Sensing Show Chinese title

Title: ARGOS：通过O-RAN感知的异常识别与防护

Abstract: Rogue Base Station (RBS) attacks, particularly those exploiting downgrade vulnerabilities, remain a persistent threat as 5G Standalone (SA) deployments are still limited and User Equipment (UE) manufacturers continue to support legacy network connectivity. This work introduces ARGOS, a comprehensive O-RAN compliant Intrusion Detection System (IDS) deployed within the Near Real-Time RIC, designed to detect RBS downgrade attacks in real time, an area previously unexplored within the O-RAN context. The system enhances the 3GPP KPM Service Model to enable richer, UE-level telemetry and features a custom xApp that applies unsupervised Machine Learning models for anomaly detection. Distinctively, the updated KPM Service Model operates on cross-layer features extracted from Modem Layer 1 (ML1) logs and Measurement Reports collected directly from Commercial Off-The-Shelf (COTS) UEs. To evaluate system performance under realistic conditions, a dedicated testbed is implemented using Open5GS, srsRAN, and FlexRIC, and validated against an extensive real-world measurement dataset. Among the evaluated models, the Variational Autoencoder (VAE) achieves the best balance of detection performance and efficiency, reaching 99.5% Accuracy with only 0.6% False Positives and minimal system overhead. Show Chinese abstract

Abstract: 伪基站（RBS）攻击，尤其是利用降级漏洞的攻击，仍然是一个持续存在的威胁，因为5G独立组网（SA）部署仍然有限，并且用户设备（UE）制造商继续支持传统网络连接。 本文介绍了一种名为ARGOS的全面O-RAN合规入侵检测系统（IDS），该系统部署在近实时RIC中，旨在实时检测RBS降级攻击，这是O-RAN环境中尚未探索过的领域。 该系统增强了3GPP KPM服务模型，以实现更丰富的用户设备（UE）级别的遥测，并具有一种自定义xApp，应用无监督机器学习模型进行异常检测。 独特之处在于，更新后的KPM服务模型基于从调制解调器层1（ML1）日志和直接从商用现货（COTS）用户设备收集的测量报告提取的跨层特征运行。 为了在现实条件下评估系统性能，使用Open5GS、srsRAN和FlexRIC构建了一个专用测试平台，并针对广泛的现实世界测量数据集进行了验证。 在所评估的模型中，变分自动编码器（VAE）在检测性能和效率之间实现了最佳平衡，在仅产生0.6%误报率的情况下达到了99.5%的准确率，并且具有最小的系统开销。