[Paper Review] Adversarial Machine Learning Threat Analysis and Remediation in Open Radio Access Network (O-RAN)

Habler, Edan, Ron Bitton+7 more|arXiv (Cornell University)|Jan 16, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper presents a systematic adversarial machine learning (AML) threat analysis and risk assessment methodology for Open Radio Access Networks (O-RAN), identifying attack vectors in ML-based use cases like traffic steering. It proposes a tool-driven framework that maps threat actors, attack techniques, and countermeasures, enabling prioritization of high-risk AML threats using a risk scoring model combining impact, likelihood, and attack effectiveness.

ABSTRACT

O-RAN is a new, open, adaptive, and intelligent RAN architecture. Motivated by the success of artificial intelligence in other domains, O-RAN strives to leverage machine learning (ML) to automatically and efficiently manage network resources in diverse use cases such as traffic steering, quality of experience prediction, and anomaly detection. Unfortunately, it has been shown that ML-based systems are vulnerable to an attack technique referred to as adversarial machine learning (AML). This special kind of attack has already been demonstrated in recent studies and in multiple domains. In this paper, we present a systematic AML threat analysis for O-RAN. We start by reviewing relevant ML use cases and analyzing the different ML workflow deployment scenarios in O-RAN. Then, we define the threat model, identifying potential adversaries, enumerating their adversarial capabilities, and analyzing their main goals. Next, we explore the various AML threats associated with O-RAN and review a large number of attacks that can be performed to realize these threats and demonstrate an AML attack on a traffic steering model. In addition, we analyze and propose various AML countermeasures for mitigating the identified threats. Finally, based on the identified AML threats and countermeasures, we present a methodology and a tool for performing risk assessment for AML attacks for a specific ML use case in O-RAN.

Motivation & Objective

• To analyze adversarial machine learning (AML) threats in Open Radio Access Networks (O-RAN), where ML is used for network management.
• To identify threat actors, their capabilities, and attack techniques targeting ML models in O-RAN deployment scenarios.
• To develop a risk assessment methodology that quantifies AML threats based on impact, likelihood, and attack effectiveness.
• To propose a practical tool for threat prioritization and countermeasure selection tailored to specific O-RAN ML use cases.
• To demonstrate the framework’s applicability through a real-world case study on traffic steering using a gradient-based white-box poisoning attack.

Proposed method

• Conduct a systematic mapping of ML deployment workflows in O-RAN, identifying key use cases such as traffic steering, QoE prediction, and anomaly detection.
• Define a threat model by enumerating potential adversaries (e.g., malicious UE, rogue RAN components) and their capabilities (e.g., model access, data injection).
• Map AML attack techniques (e.g., FGSM, PGD, C&W) to threat actors and use cases using a capability-requirement matrix with scores from 0 to 1.
• Compute risk scores using a formula: Risk = Effectiveness × (Impact × Impact of Attack) × Likelihood, where likelihood is the average of required capabilities.
• Prioritize threats using the derived risk scores, with the highest-ranked threat being a gradient-based white-box poisoning attack with a risk score of 7.90.
• Select appropriate countermeasures from a predefined ontology, such as data denoising, data sensitization, or auxiliary AML detectors, based on threat mitigation and use-case constraints.

Experimental results

Research questions

• RQ1 What are the key adversarial machine learning (AML) threats targeting machine learning models in Open Radio Access Network (O-RAN) deployments?
• RQ2 How do different threat actors in O-RAN—such as malicious user equipment or rogue RAN components—leverage AML techniques to compromise ML-based network functions?
• RQ3 What is the risk profile of AML attacks in O-RAN, and how can it be quantitatively assessed using impact, likelihood, and attack effectiveness?
• RQ4 How can a systematic risk assessment framework be applied to prioritize AML threats in a specific O-RAN use case, such as traffic steering?
• RQ5 Which countermeasures are most effective in mitigating high-risk AML threats in O-RAN, and how can they be selected based on performance and deployment constraints?

Key findings

• The most critical AML threat in O-RAN’s traffic steering use case is a gradient-based, white-box poisoning attack, with a risk score of 7.90 due to high impact and high likelihood.
• The effectiveness score of the C&W, FGSM, and PGD attack techniques was rated as 1.0, indicating they are highly effective in evading or poisoning ML models.
• The likelihood of an attack is computed as the average of required attacker capabilities, with higher scores indicating greater feasibility based on threat actor access levels.
• The risk assessment tool successfully prioritized threats using a structured, repeatable process, enabling network operators to focus on the most severe AML risks first.
• Countermeasures such as data denoising, data sensitization, and AML detection models were identified as effective for mitigating high-risk poisoning attacks.
• The framework is use-case-agnostic and can be applied to any O-RAN ML use case by reapplying the risk assessment pipeline with relevant threat and capability mappings.