AutoSec-RAN enables automated security analysis for 5G O-RAN networks
AutoSec-RAN: Specification-Grounded LLM Fine-Tuning for Automated Security Analysis of O-RAN
Cryptography and SecurityArtificial Intelligence
Summary
Security analysis for modern mobile networks like 5G’s O-RAN is complex and often requires deep packet data and expert knowledge. The authors created AutoSec-RAN, a large language model fine-tuned on official O-RAN and 3GPP specification documents, that can answer security questions without seeing raw network data. They tested it on simulated attack scenarios and found it performs well at explaining threats and suggesting mitigations. This approach uses standards-based knowledge plus retrieval techniques to help automate security investigations in O-RAN environments.
What this means in practice
- •For telecom security teams: Automate early security incident analysis for O-RAN fronthaul networks using standards-grounded natural language queries without deep packet inspection.
- •For network operators: Integrate specification-aware AI assistants for faster detection and response to distributed denial of service attacks in 5G radio access networks.
Authors
Anoop Mishra, Joshua Moore, Aly Sabri Abdalla, Vuk Marojevic
Abstract
This paper presents AutoSec-RAN, a specification-grounded large language model (LLM) framework for automated security triage of Open Radio Access Network (O-RAN) testing. Unlike approaches relying on static rule sets or privileged access to raw packet captures, AutoSec-RAN fine-tunes Mistral-7B-Instruct through two Low-Rank Adaptation (LoRA) stages over a curated corpus of 69 O-RAN, 3GPP, and adjacent standards documents, then selectively augments inference with retrieval-augmented generation (RAG) over the same specification index. At inference, the model receives only an investigator-style question and a scenario metadata block, simulating an automated analyst operating without raw packet evidence. AutoSec-RAN is validated on a purpose-built 5G/O-RAN testbed across labeled fronthaul distributed denial of service replay scenarios. A Gemma-4-31B judge LLM scores each candidate's answer on faithfulness, correctness, and actionability relative to a reference authored from full packet capture and log evidence. AutoSec-RAN achieves a mean judge overall score of 0.713 across all 313 evaluation items (0.755 restricted to the five supervised taxonomy classes), clearing the 0.70 reporting threshold, and a blended score of 0.778 (0.808 supervised-only) when cosine similarity over Beijing Academy of Artificial Intelligence (BAAI) General Embedding (BGE) is incorporated as a secondary semantic signal. The framework performs strongest on mitigation and threat-model reasoning (with a mean overall of 0.849 and 0.848, respectively) and identifies a measurable gap on the held-out attack-direction class (0.515), a controlled result that exposes a specific training data requirement. These results establish specification-grounded LoRA fine-tuning combined with RAG retrieval as a viable foundation for automated security validation of AI-native O-RAN.