Experimental Validation and Mitigation of RRC Storm Attacks in 5G Cellular Networks
2026-08-17 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors show how early steps in 5G connections can be attacked by flooding the system with fake connection attempts, which overloads the base station and blocks real users. They recreated this problem on real hardware using software radios and phones. To stop this, they created a simple defense that watches for suspicious half-finished connections and acts on them directly at the base station. They also made a tool to visualize network activity and highlight attacks in real time. Their work is shared openly for others to test and improve on.
5Gbase station (gNB)random access channel (RACH)signaling stormsoftware-defined radionetwork managementopen sourcehalf-open connectionsinitial access phase
Authors
Abdallah Abou Hasna, Ammar El Falou
Abstract
The initial access phase of the 5G system remains sensitive because the base station (gNB) must allocate radio resources before the user is fully authenticated. In particular, the random access channel (RACH) procedure can be abused to generate large numbers of incomplete connection attempts, creating a signaling storm that consumes gNB resources and prevents legitimate users from connecting successfully. In this paper, we implement this signaling storm attack using the OpenAirInterface project and validate it on a real testbed composed of software-defined radios and commercial phones. We then design and implement a lightweight mitigation technique that operates directly at the gNB by monitoring and acting on suspicious half-open connections. To make the system observable in practice, we also develop a network management interface that visualizes the network state in real time and highlights suspicious activity during the attack phase. Finally, the work is released as open source so that other researchers can reproduce our results, build on the implementation, and evaluate new mitigation strategies.