Open Radio Access Networks (O-RAN) offer a disaggregated, open alternative to the inflexible and monolithic design of current RAN architectures. The inherent result of the more open O-RAN architecture is an enlarged attack surface, making security a critical focus.

In this paper, the OpenAirInterface and OCUDU test beds, together with the FlexRIC and ORAN-SC near-RT RICs and the OAI-CN5G and Open5GS 5G core networks, are evaluated for vulnerabilities. By exploiting the unencrypted SCTP communications, it was possible to perform a masquerading attack that spoofs O-RAN components, a shutdown attack that injects shutdown messages to stop connections, and a heartbeat attack injecting heartbeat messages with malicious payloads into O-RAN connections.

The attacks found in this research, in combination with the characteristics of the SCTP protocol used in the O-RAN network, allow for the breaking of connections between O-RAN components internally, between network functions in the 5G core, and the near-RT RIC. The breaking of these connections triggers implementation vulnerabilities in the OpenAirInterface and OCUDU test beds, as well as the FlexRIC and ORAN-SC near-RT RICs. These vulnerabilities cause the components to crash or communications between them to be severed permanently.

To secure the O-RAN architecture, strict compliance with the O-RAN specification by implementing IPSec is necessary, together with robust error handling that can safely manage dropped connections and failed connection setup.
... Read more

The rise of edge computing has enabled a wide range of applications that require decentralized processing and closer interaction with end devices, including telecommunications, industrial automation, distributed multimedia, and IoT systems. In contrast to comparatively homogeneous cloud environments, edge infrastructures often consist of heterogeneous hardware platforms with different architectures, capabilities, and management constraints. This diversity makes experimental evaluation harder to reproduce and operationally more difficult to manage.

This thesis presents the design and implementation of a multi-tenant edge testbed for heterogeneous hardware. The testbed supports both exclusive access to individual devices and shared use of device resources through multiple execution environments. It also supports multiple deployment styles, ranging from direct use of provisioned execution environments to the deployment of additional services on top of them. Target applications include 5G radio access and core network functions, as well as distributed augmented reality pipelines. To support these goals, the system is organized into infrastructure, orchestration, and service layers that address hardware abstraction, multi-tenant experiment management, and user-facing experiment specification and deployment.

The proposed design is evaluated in three ways. First, virtualization choices are assessed on representative devices to determine suitable execution environments for shared and exclusive access. Second, the platform is demonstrated through 5G and distributed augmented reality deployment scenarios. Third, interference under concurrent use is evaluated both on shared hosts and at shared network bottlenecks.

The results indicate that the proposed design provides a practical basis for reproducible multi-tenant experimentation across heterogeneous edge devices and diverse deployment configurations, while also clarifying the remaining limits imposed by shared physical infrastructure under contention. ... Read more

Cloud-native 5G core networks generate large volumes of heterogeneous log data across multiple microservice components, making telemetry management a critical operational challenge. Most existing log reduction techniques have not been evaluated on 5G core logs in particular, so the best approach for reducing log volume in such a system remains unclear. This paper investigates five log reduction strategies - LogShrink, Denum, SALO, Drain and Log Preprocessing - applied to an Open5GS deployment on a Kubernetes-in-Docker cluster under ten scenarios (steady-state, bursty traffic, and eight fault injections). The strategies are evaluated across volume reduction, CPU overhead and five system visibility metrics.
The two strategy families (online and offline) operate on different inputs and use separate baselines, so their figures are not directly comparable. Lossless offline strategies (LogShrink and Denum) achieve 83–96% byte reduction with full visibility preservation, with Denum far more resource-efficient than LogShrink. Lossy online strategies (SALO, Log Preprocessing, Drain), on the other hand, reduce real-time log streams by 53–89% at low cluster overhead but significantly reduce fault-signal retention. No single strategy dominates all dimensions simultaneously. The study provides a framework for selecting log reduction strategies in cloud-native 5G deployments based on specific operational constraints. ... Read more

5G core networks are moving from monolithic applications to containerised microservices on Kubernetes. This brings flexibility and scalability, but it also makes faults harder to detect, since a single fault can surface in the physical infrastructure, the Kubernetes orchestration, and the network functions at the same time. There is little empirical evidence on which telemetry signals reveal which kind of fault. This paper presents a fault atlas for a cloud-native 5G core: an empirical mapping from 22 injected faults in eight classes (resource stress, pod crashes, network degradation, attacks on the Packet forwarding Control Protocol (PFCP), and dependency failures) to the 40 observability signals, collected from metrics (including user-plane round-trip time), logs, traces, and Kubernetes events, that detect them. On our setup, all but one of the 22 faults were detectable in more than one architecture layer, and within each fault class the layers reacted in a stable order. The orchestration layer, typically the most closely watched one, detected only 10 of the 22 faults and missed all CPU-stress, network-delay, and PFCP-attack faults, while 21 of the 22 faults were visible in more than one of the four telemetry modalities. The atlas is robust to the statistical methodology (at least 95.9% of signals unchanged under threshold and detector variations), and a second independent run agreed on 93.1% of its cells, with the differences confined to near-threshold signals. The atlas and the pipeline that generated it are released as a reusable ground truth for fault-detection and cross-layer diagnosis research. ... Read more

Cloud-native 5G core networks transform network functions into containerised microservices, which simplifies their management but fragments their observability across multiple telemetry layers. Monitoring these systems requires balancing between visibility and the overhead created by the control plane being observed. This paper evaluates two fundamentally different collection paradigms: pull-based scraping via Prometheus and eBPF auto-instrumentation via Grafana Beyla, on a live Open5GS 5G core deployed on a three-node Kubernetes cluster. Each stack is deployed in isolation and in combination: resource overhead is quantified across multiple granularity settings, scalability is measured by changing the number of Network Functions (NFs) being monitored at a time, and fault-detection coverage is assessed over 22 injected scenarios across five fault classes, using Chaos Mesh for controlled injection. Prometheus incurs substantially higher monitoring stack overhead; Beyla’s sampling rate has negligible effect on the cost, because kernel uprobes fire on every HTTP/2 library call regardless of the sampling decision. For fault observability, across all 3 runs, Beyla flags all 22 fault types in at least one of those runs, while Prometheus misses only one (NRF cascade failure). However, throughout all three runs together, only 10 / 22 faults are detected reliably by both methods. Per-run reliability favours Prometheus (87.9% vs. 81.8%). We conclude that Beyla offers broader fault-type coverage at lower overhead, but Prometheus provides more consistent detection per individual injection. ... Read more

Modern cloud-native systems generate large amounts of telemetry data, including logs, metrics, and traces, which are useful for monitoring and diagnosing system behavior. However, the effectiveness of machine learning-based anomaly detection varies significantly depending on the telemetry modality and the nature of the faults.

With the ever-increasing demands of 5G applications and upcoming 6G systems, operators must ensure that their networks can rapidly respond to and mitigate faults, with detection being the first step. This project investigates the performance of machine learning models for anomaly detection when logs, metrics, and traces are analyzed independently, with the goal of understanding their relative strengths and limitations.

The study analyzes the performance of fifteen models across five different fault classes, comprising 22 faults in total. After creating an appropriate dataset, each model was evaluated using data collected from several runs. The results show that a single modality cannot detect all faults, two modalities can detect all but one fault, and all three modalities together can detect every fault. ... Read more

Cloud-native 5G Core networks emit metrics, logs, and distributed traces, yet faults are typically diagnosed within a single modality. We show that the relationships between these modalities carry fault information that single-signal analysis misses, and we use them to characterize faults in a containerized Open5GS testbed. Our method computes the change in Spearman rank correlation between cross-modal signal pairs, from a pre-fault baseline to the fault window, yielding a coupling-change metric ∆|ρ|. Across 22 operational fault scenarios over seven independent deployments, and 6 security scenarios over three, the analysis surfaces reproducible coupling signatures and, more importantly, modality blindspots that follow the 5G interface architecture: because distributed tracing instruments only the Service-Based Interface, N2 interface partitions and N4/PFCP session faults are trace-blind and characterizable only through metrics-logs coupling, whereas a valid-request NRF flood produces no error logs. No single modality covers every fault type. We treat classification as an analytical instrument rather than a goal: cross-modal coupling features are deliberately weaker classifiers than raw per-signal features, and a SHAP analysis shows the two views rely on different modality pairs, consistent with the coupling view’s value being characterization rather than accuracy. The security-fault results are preliminary, owing to the small, low-variance dataset. The contribution is a reproducible, architecture-grounded map of which modality reveals, and which is blind to, each fault. ... Read more

This thesis presents Media over Multipath QUIC (MoMQ), a design that extends Media over QUIC Transport (MoQT) with multipath-aware object delivery. The core contribution of MoMQ is a rule-based mechanism that allows endpoints to install object-to-path mapping rules, enabling relays to schedule media objects across multiple network paths according to application-level delivery preferences. These rules operate on generic object metadata, allowing relays to remain application-agnostic while supporting fine-grained, semantics-aware media distribution.

The motivation for MoMQ stems from the limitations of single-path transport for emerging real-time media applications. High-resolution video, ultra-low-latency cloud gaming, and high-frame-rate video conferencing increasingly approach the performance limits of a single network path. Multipath QUIC provides a standards-compliant transport substrate that can aggregate heterogeneous network resources and improve resilience, making it a necessary building block for future real-time media systems.

However, transport-layer-only multipath scheduling is insufficient to meet the strict latency and quality requirements of real-time media without guidance from application semantics.

MoMQ bridges this gap by exposing a controlled interface through which applications can express delivery preferences, while preserving MoQT’s decoupled relay architecture. As a result, MoMQ can flexibly support diverse real-time applications, including live streaming and video conferencing, without binding relays to specific application logic.

To evaluate the proposed design, this thesis analyzes the stringent requirements of video conferencing under advanced encoding strategies such as Scalable Video Coding (SVC) and derives MoMQ scheduling policies accordingly. A prototype system is implemented and deployed in a real-world multipath environment consisting of a terrestrial WiFi link (representative of typical 4G LTE characteristics) and a Low Earth Orbit (LEO) satellite link. Transport-only baseline measurements confirm that existing multipath schedulers fail to improve upon single-path tail latency, motivating the need for application-level scheduling guidance. Four declarative MoMQ rules addressing P-frame interleaving, reconfiguration avoidance, dependency co-location, and cost-sensitive path preference collectively reduce P99.9 frame completion time by 39% compared to the best single-path baseline and by 63% compared to the best transport-only multipath scheduler, while routing only approximately 8% of traffic over the metered backup path. ... Read more

Low Earth orbit satellite internet networks such as Starlink, OneWeb, and Amazon LEO (formerly known as Project Kuiper) have in recent years emerged as a new way to access the internet. These systems offer the possibility of high-speed and low-latency connectivity in remote regions, but have also been introduced as potential options for use in emergency situations. As these technologies become more commonly used for critical applications, it is important to analyze how resilient these networks are, and how they may be vulnerable to various threats. LEO satellite internet is enabled by a network of ground stations, satellites, and user terminals. Since the ground stations are terrestrial, they can be vulnerable to threats such as natural disasters or power outages. As a result, analyzing the effect of terrestrial disruptions on the performance of satellite networks provides insight into how the service can be adversely affected. Using simulated models of Starlink, OneWeb, and Amazon LEO combined with case studies based on the 2025 Iberian Peninsula power outage and the 1960 Valdivia earthquake, it was found that optical inter-satellite links (ISL) significantly contribute to the resilience against terrestrial disasters. ISL-enabled networks such as Starlink and Amazon LEO enable alternative connections to more distant ground stations, thus avoiding a loss of regional coverage. This rerouting results in an increased link latency within the region.Simulated disasters in space were also analyzed. A distributed attack on satellites based on their betweenness centrality revealed that constellations with a larger quantity of satellites degraded more slowly. Additionally, an analysis of regional satellite outages revealed that a damaged satellite cluster can propagate to different regions, causing a local decrease in the satellite density. By analyzing the motion of the satellite constellation after a 3000 km radius disruption, it was found that constellations containing different orbital altitudes experienced a passive redistribution of satellites over time, stabilizing after 2-4 days. Additionally, deliberate maneuvering restored the density in approximately 4 days for Starlink and OneWeb, with the lower-thrust Amazon LEO satellites taking approximately 7 days.This work aims to provide insight into an often overlooked aspect of the emerging satellite networks, by showing that the resilience of these networks is affected by many distinct factors such as inter-satellite connectivity, ground stations, orbital mechanics, and more.
... Read more

Previous literature had accentuated the importance of close ground infrastructure (Ground Stations and Points of presence) on the network performance of Starlink. In order to further investigate this relation, a new method was defined, based on IPv4traceroute, to identify the PoP associated with a Starlink user. This method has been evaluated for 95 RIPE Atlas probes connected to the Starlink network and the results have been mapped in an interactive web-tool. Using this data, a strong correlation between latency and proximity to ground infrastructure was verified. ... Read more

The global adoption of 5G technology is rapidly accelerating and 5G traffic is growing exponentially. This increase in demand compels network operators to evaluate whether their current and upcoming 5G infrastructure can effectively accommodate the growing data traffic. A key component within the 5G network is the User Plane Function (UPF), which connects the end-devices to the data networks. Therefore, it is vital for both equipment manufacturers and service providers to analyze the performance of existing UPF implementations. This paper presents an initial approach to assess the Open5GS UPF performance by conducting stress testing in virtualized environment. We focus on finding the optimal UPF configuration by measuring the resource consumption and latency of the UPF under varying intensity of generated traffic, and providing a simple queueing model for the UPF. Numerical results show that a CPU load of 70-80% balances between latency and throughput while ensuring that 99% of the packets are forwarded within 150 ms. ... Read more

Low Earth Orbit (LEO) satellite constellations, particularly SpaceX’s Starlink, have quickly gained popularity and have become a viable alternative to traditional terrestrial Internet Service Providers (ISPs) in recent years. However, due to their novelty and unique architecture, research into their performance is limited, especially one comparing LEO and terrestrial internet. This paper will demonstrate how user-initiated active measurements can be used to both gather new data about LEO internet and assess and compare the performance of individual networks. First, performance metrics that reflect typical internet usage scenarios, such as web browsing and video streaming, are chosen. Next, a test suite is developed to collect data about one’s network. It also augments this data with location information to aid in later comparison. This data can then be used for comparisons between individual networks as well as in further research. The last step integrates the suit developed into a web based platform that aims to provide a wide variety of information about Starlink’s performance, architecture and allow users to gauge the potential benefits of transitioning from terrestrial to LEO internet could provide them. ... Read more

The rise of Low-Earth-Orbit (LEO) satellite networks, such as Starlink, has transformed global connectivity, enabling high-speed internet access in previously underserved regions. However, existing research lacks a unified framework to evaluate and compare the performance of LEO ISPs against terrestrial alternatives using heterogeneous measurement datasets. In this work, we present a methodology for harmonizing and standardizing passive internet measurements from M-Lab’s NDT7 and Cloudflare’s AIM datasets, implemented in the form of the Global Telemetry System. These sources are integrated through schema unification, filtering, and normalization to produce a reproducible and geographically comprehensive telemetry dataset. We introduce a server-based filtering approach to mitigate geographic and routing biases, and we evaluate aggregation methods to align measurement distributions across datasets. Our results demonstrate the dataset integration methodology preserves key distributional properties, enabling fair and statistically consistent merging of measurements from the two sources. This work represents a first step toward a scalable and extensible telemetry infrastructure for assessing next-generation global internet services.
... Read more

We present a machine learning framework aimed at forecasting Starlink (LEO satellite) network performance at fine spatiotemporal resolution. Our approach combines MLab crowdsourced measurements, weather and forecast features, and dynamic satellite density to predict packet loss, jitter, latency, and throughput. We introduce a composite Weather Index and real-time satellite density per location, and train robust ensemble models with anomaly filtering and median aggregation. Our best models achieve good predictive results with less than 17 ms for latency, and 35 Mbps for throughput. Latency is reliably predictable with meteorological and satellite context, while packet loss and jitter remain challenging. Predictions are limited to periods close to the training data and our results establish a reproducible baseline for short-term, weather-aware Starlink network forecasting. ... Read more

Modern mobile networks must adapt to rapidly changing traffic patterns and increasing user demands. A key challenge is understanding where user traffic terminates and how these destinations vary over time. This thesis addresses this challenge by introducing an open-source, modular analysis framework that analyzes passive Internet traffic traces, enriches them with geolocation and organizational metadata, and infers latency stability and routing dynamics, in order to characterize the infrastructures that terminate user traffic and assess their performance and reliability over time. The results show a long-term shift towards content-centric traffic, highlight geographic and temporal variations in performance, and demonstrate that content networks typically offer greater stability than enterprise or research destinations. These findings support adaptive traffic management strategies in 5G and future 6G networks. ... Read more

With the exponential growth of mobile traffic in 5G networks, accurate forecasting is essential for efficient resource management. This research provides a comparative analysis of time series forecasting models for predicting near-future network traffic. Using a public dataset from a 5G base station in Barcelona, this study evaluates the performance of a traditional statistical model, against deep learning models: a Recurrent Neural Network (RNN), a Long Short-Term Memory (LSTM) and a Google timesFM model. The results demonstrate that while the SARIMAX model struggles to capture near-future traffic demand, the deep learning approaches yield significantly higher predictive accuracy. Specifically, a simple LSTM architecture shows great results, outperforming even a more complex one. However, the timesFM model, in particular, shows the most robust generalization capabilities. Additionally, the models trained on data from one base station do not generalize well to others, highlighting significant differences in traffic characteristics even between geographically close locations. This suggests that while locally trained LSTMs are a powerful tool, future work should focus on developing more adaptive and transferable models, such as those using federated learning or graph neural networks.^p ... Read more

Academic research in 5G networking faces a lack of accessible, realistic packet-level datasets, limiting innovation and reproducibility. This paper evaluates two state-of-the-art machine learning approaches, PAC-GAN and TabularARGN, for generating synthetic 5G TCP/IP packet headers. Using a real 5G packet-capture dataset, we adapt both models to include inter-packet timing and rigorously assess them on protocol validity, marginal distribution alignment, and joint distribution fidelity. Results show that PAC-GAN produces highly valid and statistically faithful synthetic packets, effectively modeling complex header dependencies and temporal patterns. While TabularARGN ensures strict protocol compliance, it struggles to capture higher-order correlations and traffic diversity. Our findings establish convolutional generative models like PAC-GAN as practical tools for producing realistic, protocol-compliant synthetic 5G traffic, broadening access to datasets for benchmarking and security testing. ... Read more

This paper investigates the latency and resilience of user-plane anchor reconfiguration in a fully virtualized 5G core environment using Open5GS and UERANSIM. The experiment spans five VirtualBox virtual machines, each hosting a key component of the 5G core or radio stack: 5G-core gNB, UPF1, UPF2, and a single UE. All nodes communicate over a shared internal network, ensuring controland user-plane traffic remains isolated from external variability. The UE is initially anchored to UPF 1 via DNN “internet.” After the initial tunnel is established and validated, a re-anchoring procedure is triggered by calling the SMF’s REST API. Although the endpoint is intended to perform a PFCP Session Modification, Open5GS tears down the session and creates a new one on UPF 2 instead. By analyzing timestamped UE logs—capturing tunnel setup, session release, and re-establishment—we measure the latency of user-plane reattachment. Our results reveal high variability in recovery times, ranging from sub-second to over 50 seconds. These inconsistencies are attributed to limitations in Open5GS’s session handling, the lack of true migration support, and hardware limitations of the used machine. Despite these challenges, the study offers insights into the practical behavior of PFCP-driven anchor reconfiguration and the operational gaps that remain in open-source 5G core implementations. ... Read more