Holding the Line: Multi-Stage Jamming Classification in 5G O-RAN

Abstract

Jamming attacks threaten 5G networks, yet most existing detection methods rely on simulated data and lack deployment on standardized O-RAN architectures. We present a multi-stage jamming classification framework deployed on a real 5G O-RAN testbed that classifies seven distinct jamming attack types—including protocol-aware attacks targeting PSS, PDCCH, and DMRS—with 100% detection for six of seven modes (91.9% for PDCCH) and 5.3% false positive rate. Our three-stage cascade combines: (1) a multilayer perceptron (MLP) for fast 5-class KPI-based classification, (2) a sliding-window kernelized support vector machine (KSVM) that extracts 12-dimensional temporal statistics to detect intermittent attacks invisible to per-sample classifiers, and (3) a MobileNetV3 convolutional neural network for I/Q spectrogram-based protocol-aware sub-classification achieving 85% accuracy across four sub-types. We further implement a prototype machine learning operations (MLOps) path with Gaussian mixture model (GMM)-based telemetry labeling, retraining orchestration, and model hot reload. Stage 1/2 results use blocked temporal 5-fold cross-validation on 1,492 real KPI samples with zero train/test overlap; Stage 3 performance is evaluated on 200 real I/Q captures. Experiments on the CCI xG Testbed with three USRP X310 software-defined radios demonstrate a cascade processing latency of ≤23 ms (p95), within the typical Near-RT RIC operating timescale of 10 ms to 1 s.