Radio-Signal-Driven IDS using dApps in Open RAN | Demo

In this demo, we present a real-world implementation of a dApp-based Intrusion Detection System for 5G O-RAN, as proposed in our paper “Silent Signals, Loud Threats: Using dApps for Radio Signal Intelligence-based Intrusion Detection in 5G O-RAN” (IEEE Globecom 2025).

This demonstration highlights how radio-telemetry-driven IDS deployed as dApps at the Distributed Unit (DU) can detect attacks significantly earlier and with far lower computational cost compared to traditional xApp-based IDS approaches running at the Near-RT RIC.

Using our live 5G O-RAN testbed—including real UEs, Benetel RUs, OAI CUs, and two DUs—we show how the RIDGE dApp observes PHY/MAC-layer metrics (RSRP, SINR, CQI, BLER, MCS, etc.) in real time and classifies anomalies using lightweight ML models.

Watch as we walk through:
• Deployment of the RIDGE IDS dApp directly at the DU
• Real-time capture of radio-signal telemetry over the E2 interface
• ML-based detection of SYN floods, UDP floods, ICMP floods, and port scans
• Comparison of detection accuracy between DU dApps and RIC-level xApps

The demo demonstrates how dApps transform O-RAN security by enabling localised, low-latency threat detection, reducing backhaul overhead, and isolating malicious UEs before attacks propagate deeper into the network.

🔑 Key Highlights

• Radio-telemetry-driven IDS using DU-level dApps
• Lightweight ML models for real-time inference with minimal CPU/memory
• 70–90% lower resource consumption compared to xApp-based IDS
• Dual dataset creation: DU telemetry + CU network flows
• Near-perfect detection accuracy across multiple attack types
• Designed for scalable O-RAN deployments in production environments

📘 Learn More

Read the full paper on Researchgate
https://www.researchgate.net/publicat...

Or visit our lab website for related research:
https://netslab.ucd.ie