Cross-O-DU Detection of RRC Signaling Storms in 5G O-RAN Networks

Abstract

Open Radio Access Network (O-RAN) adopts a disaggregated Radio Access Network (RAN) architecture in which O-RAN Centralized Units (O-CUs) and Distributed Units (O-DUs) expose telemetry to operator applications. I use this architecture to detect signaling storms: deliberate or accidental surges of connection-establishment signaling that can degrade service before devices authenticate. Detection is difficult for two reasons. First, a distributed storm can produce moderately elevated evidence at several O-DUs without crossing a per-O-DU alarm threshold. Second, some random-access attempts fail inside the O-DU before their RRC request reaches the O-CU, so O-CU RRC counters alone omit part of the load. I present a tiered, unsupervised detector: one Isolation Forest per O-DU produces calibrated anomaly scores, and a cross-O-DU LSTM-autoencoder/Isolation-Forest ensemble combines the continuous scores and signaling counters. Model fitting and threshold calibration use benign operation only. I also implement a custom E2 service model that exports per-O-DU RRC counters and O-DU MAC scheduler-outcome counters. Across ten storm scenarios, the detector obtains 0.991 PR-AUC; its recall is 0.943 at a threshold calibrated to the 95th percentile of benign scores, compared with 0.972 and 0.860 for the strongest unsupervised baseline. At the 10s operating window, cross-O-DU combination raises recall on the rolling, low-intensity coordinated scenario from 0.27 to 0.81.