Cross-Layer Detection of Wireless Misbehavior Using 5G RAN Telemetry and Operational Metadata

TL;DR

This paper demonstrates that cross-layer relationships in 5G RAN telemetry can reliably detect uplink misbehavior by analyzing distinct signatures caused by manipulations like power inflation and timing drift, without requiring protocol changes.

Contribution

It introduces a novel method for detecting uplink misbehavior in 5G networks using existing telemetry streams and cross-layer analysis, avoiding the need for new signaling protocols.

Findings

Distinct signatures for each manipulation are reproducible.

Cross-layer coherence reveals misbehavior signatures.

Method requires no protocol modifications.

Abstract

5G Standalone deployments can exhibit uplink misbehavior from user equipment that remains fully compliant with standard control plane procedures. Manipulations such as transmit power inflation, gradual timing drift, and short off grant bursts leave the signaling state intact but distort the expected relationships among the telemetry streams produced by the gNB. This work examines whether these cross layer relationships can serve as a reliable basis for identifying such misbehavior without introducing new signaling. Using a controlled 5G Standalone testbed with commercial user equipment and a software defined radio adversarial device, we study how each manipulation affects the coherence among physical layer measurements, MAC scheduling decisions, and configuration metadata. The results show that every manipulation produces a distinct and reproducible signature that is not visible from any single telemetry source. Power offsets weaken the natural connection between SNR and CQI, timing drift breaks the alignment maintained by the scheduler, and off grant activity produces uplink energy that does not agree with allocation logs. These inconsistencies appear in merged multi layer time series traces and in cross domain views such as the SNR to CQI plane. The findings indicate that cross layer coherence provides a practical signal for detecting uplink misbehavior using only standard gNB telemetry, with no protocol modifications required, which makes the method suitable for integration into operational monitoring and auditing systems.