telecom security teams

Abstract: This paper presents AutoSec-RAN, a specification-grounded large language model (LLM) framework for automated security triage of Open Radio Access Network (O-RAN) testing. Unlike approaches relying on static rule sets or privileged access to raw packet captures, AutoSec-RAN fine-tunes Mistral-7B-Instruct through two Low-Rank Adaptation (LoRA) stages over a curated corpus of 69 O-RAN, 3GPP, and adjacent standards documents, then selectively augments inference with retrieval-augmented generation (RAG) over the same specification index. At inference, the model receives only an investigator-style question and a scenario metadata block, simulating an automated analyst operating without raw packet evidence. AutoSec-RAN is validated on a purpose-built 5G/O-RAN testbed across labeled fronthaul distributed denial of service replay scenarios. A Gemma-4-31B judge LLM scores each candidate's answer on faithfulness, correctness, and actionability relative to a reference authored from full packet capture and log evidence. AutoSec-RAN achieves a mean judge overall score of 0.713 across all 313 evaluation items (0.755 restricted to the five supervised taxonomy classes), clearing the 0.70 reporting threshold, and a blended score of 0.778 (0.808 supervised-only) when cosine similarity over Beijing Academy of Artificial Intelligence (BAAI) General Embedding (BGE) is incorporated as a secondary semantic signal. The framework performs strongest on mitigation and threat-model reasoning (with a mean overall of 0.849 and 0.848, respectively) and identifies a measurable gap on the held-out attack-direction class (0.515), a controlled result that exposes a specific training data requirement. These results establish specification-grounded LoRA fine-tuning combined with RAG retrieval as a viable foundation for automated security validation of AI-native O-RAN.

Abstract: Prior studies on wideband physical layer security (PLS) have mostly focused on either far-field or near-field communication systems. In this paper, we investigate PLS in a more general and practical mixed near-field and far-field wideband communication scenario, where a base station (BS) equipped with an extremely large-scale array (XL-array) serves multiple legitimate users in the far field, while a near-field eavesdropper attempts to intercept confidential information at close range. Specifically, we formulate an optimization problem to maximize the secrecy rate of all legitimate users across all subcarriers by jointly designing the transmit beamforming and artificial noise (AN), subject to per-subcarrier power constraints. To gain useful insights into the unique characteristics of mixed-field wideband PLS, we first analyze a special case with a single legitimate user and an eavesdropper. Interestingly, we show that the secure transmission regions in mixed-field wideband systems are not the same across all subcarriers, as revealed by subcarrier-specific secrecy conditions derived from the Fresnel integrals. Moreover, we theoretically demonstrate that introducing frequency-selective AN into the system offers two key benefits: 1) it transforms originally insecure subcarriers into secure ones, and 2) it substantially improves the overall secrecy performance. For the general multiuser setup, we propose an efficient two-stage hybrid beamforming algorithm to jointly design the transmit beamforming and AN, ensuring secure transmission under mixed-field conditions. Building on our analytical insights, we further develop an efficient and low-complexity algorithm that designs the AN beamformers by directly aligning them with the eavesdropper's channel, thereby eliminating the need to optimize AN beamformers across all subcarriers.

Abstract: Telecom fraud scripts evolve rapidly and are often designed to resemble routine service conversations, creating two key requirements for audio-based telecom-fraud evaluation. First, benchmarks must incorporate newly observed scam patterns without overwriting previously established test sets. Second, they must distinguish fraud from lawful, near-domain calls rather than relying on topic-separated negative examples. We present TeleAntiFraud 2.0, constructed with our Mixed-Tree Anti-Fraud Generation Pipeline and evaluated under a monthly frozen evaluation protocol. The pipeline transforms online fraud-case abstracts into profile-grounded scenarios, expands them through mixed-tree generation, realizes fraud and non-fraud dialogue paths under shared contexts, renders validated dialogues as role-matched speech, and freezes the resulting audio, labels, prompts, manifests, and provenance records for each monthly evaluation set. Each frozen set contains 900 Chinese calls, comprising 600 fraud and 300 near-domain non-fraud cases. Controlled text experiments show that three classifiers achieve perfect macro-averaged F1 (Macro-F1) when evaluated against unrelated or ordinary negatives, but drop to 0.65-0.68 with near-domain sibling negatives. Full-set audio and automatic-speech-recognition plus large-language-model (ASR+LLM) evaluations further reveal class-prior shortcuts, prediction collapse, and snapshot sensitivity. Together, these findings establish near-domain construction and collapse-aware reporting as core requirements for evaluating audio-based telecom-fraud models under realistic confusable conditions. The accompanying research artifact includes the construction code, evaluation scripts, manifests, and documentation. Our dataset and code are available at https://anonymous.4open.science/r/TeleAntiFraud-2_0-EEB2/.