DETECTION AND MITIGATION OF RRC SIGNALING STORMS IN O-RAN-BASED 5G LEO NON-TERRESTRIAL NETWORKS

The thesis investigates the use of the Open RAN architecture in 5G Non-Terrestrial Network (NTN) scenarios, with a particular focus on the detection and mitigation of attacks targeting the radio access network through the integration of a Near-RT RAN Intelligent Controller and a dedicated xApp. The experimental work is based on a testbed integrating OpenAirInterface (OAI) for the RAN, Open5GS for the core network, and a USRP X410 SDR platform for the radio segment. A Keysight Propsim channel emulator is used to reproduce realistic LEO satellite scenarios, including the propagation delay and Doppler effects associated with satellite motion. Within this framework, an RRC Storm attack scenario is implemented, in which a high volume of connection attempts progressively saturates the signalling resources and available UE contexts of the gNB. The impact of such an attack is particularly relevant in NTN environments, where the increased and time-varying propagation delay affects the timing of RRC procedures and may prolong the occupation of radio access resources. The proposed solution separates attack detection from mitigation enforcement. A dedicated xApp running on the Near-RT RIC monitors RAN metrics collected through the E2 interface and identifies anomalous signalling behaviour associated with the RRC Storm attack. Once the attack is detected, the xApp can trigger the activation of the resilience mechanism through RIC Control, while the actual mitigation is implemented locally at the gNB. In particular, the gNB autonomously manages and releases incomplete RRC procedures in order to prevent prolonged context occupation and preserve access for legitimate UEs. The final objective is therefore to assess the effectiveness of the proposed closed-loop architecture under realistic satellite channel conditions, evaluating both the attack-detection performance of the xApp and the ability of the gNB-side mitigation mechanism to restore and maintain network accessibility during an ongoing signalling storm.