arXiv subjects

Leonardo Bonati

Publications and source records attributed to Leonardo Bonati.

At least 19 recordsLinked to original sources

arXiv2026

StormShield: Fingerprint-Based Detection and Mitigation of RRC Signaling Storms in O-RAN 5G RANs

5G networks provide low-latency, high throughput, and massive connectivity, yet the control plane remains exposed to several security threats. Among the most common and impactful threats are Denial-of-Service (DoS) attacks, with Radio Resource Control (RRC) signaling storms being particularly effective and difficult to mitigate. In this attack, a malicious User Equipment (UE) aims to exhaust Next Generation Node Base (gNB) resources, preventing legitimate UEs from establishing a connection. Existing defenses are typically limited to detection, only evaluated through numerical simulations, and cannot discern between high-load network conditions and attacks. Most of them also assume static setups and do not take mobility into account. In this paper, we first evaluate the feasibility of the signaling storm attack by using the OpenAirInterface(OAI) 5G protocol stack. Then, we propose StormShield, a signaling storm attack detection and mitigation technique implemented as an xApp on an O-RAN Near-Real-Time (near-RT) RAN Intelligent Controller (RIC). It fingerprints and blocks Malicious UEs (MUEs) before gNB resources are exhausted. We prototyped our solution on an Over-The-Air (OTA) testbed with OAI, NVIDIA Aerial, and two different gNB setups. The first one leverages an USRP X410 Software-defined Radio (SDR) with 8.1 functional split; the second a commercial Foxconn Radio Unit (RU) with 7.2 functional split. Our experimental evaluation demonstrates that StormShield effectively prevents gNB resource exhaustion, identifying and blocking MUEs with an average detection accuracy of 97.6% within 106.5 ms from the beginning of the attack.

cs.NI↗

arXiv2026

RANalyzer: Automated Continuous RAN Software Evaluation and Regression Analysis

Software-driven O-RAN architectures enable rapid innovation through frequent, independent updates to virtualized components. However, attributing performance variations to specific software changes is challenging due to the stochastic nature of wireless systems, where channel conditions, interference, and hardware variability confound analysis. Traditional threshold-based monitoring and manual troubleshooting do not scale with modern software evolution. This paper presents RANalyzer, an automated test analysis framework that quantifies the performance impact of software updates beyond what can be explained by wireless channel conditions. RANalyzer combines LLM-assisted semantic extraction with residuals analysis. The first categorizes code changes by affected protocol layers and functional components, while the second provides insights on the effect of load, channel, or code changes on the test performance. We contribute an extensive dataset collected over more than two years of continuous over-the-air testing on an experimental O-RAN testbed, comprising over 8,600 automated tests across 69 releases of the OAI stack. By modeling expected performance and interpreting deviations as software-induced effects, we identify degraded instances attributable to code changes and correlate them with specific change categories. The framework can be integrated into CI/CD/CT pipelines for automated, continuous evaluation of software updates at scale.

cs.NI↗

arXiv2026

Predicting Conflict Impact on Performance in O-RAN

The O-RAN Alliance promotes the integration of intelligent autonomous agents to control the Radio Access Network (RAN). This improves flexibility, performance, and observability in the RAN, but introduces new challenges, such as the detection and management of conflicts among the intelligent autonomous agents. A solution consists of profiling the agents before deployment to gather statistical information about their decision-making behavior, then using the information to estimate the level of conflict among agents with different goals. This approach enables determining the occurrence of conflicts among agents, but does not provide information about the impact on RAN performance, including potential service degradation. The problem becomes more complex when agents generate control actions at different timescales, which makes conflict severity hard to predict. In this paper, we present a novel approach that fills this gap. Our solution leverages the same data used to determine conflict severity but extends its use to predict the impact of such conflicts on RAN performance based on the frequency at which each agent generates actions, giving more weight to faster applications, which exert control more frequently. Via a prototype, we demonstrate that our solution is viable and accurately predicts conflict impact on RAN performance.

cs.NI↗

arXiv2026

TENORAN: Automating Fine-grained Energy Efficiency Profiling in Open RAN Systems

The transition to disaggregated and interoperable Open Radio Access Network (RAN) architectures and the introduction of RAN Intelligent Controllers (RICs) in O-RAN creates new resource optimization opportunities and fine-grained tuning and configuration of network components to save energy while fulfilling service demand. However, unlocking this potential requires fine-grained and accurate energy measurements across heterogeneous deployments. Three factors make this particularly challenging [...]. To address these challenges, we design the TENORAN framework, an automated measurement scaffold for fine-grained energy efficiency profiling of O-RAN deployments, and prototype it on a heterogeneous OpenShift cluster. TENORAN instruments an end-to-end deployment based on high-level specifications (e.g., gNB software stack and split options, traffic profiles), and collects synchronized performance metrics and power measurements for individual RAN components while the network is under controlled workloads including over-the-air traffic. Our experimental results demonstrate energy profiling of end-to-end experiments with xApps in the loop, energy efficiency differences between two RAN stacks, OpenAirInterface and srsRAN, in uplink and downlink, and core network power consumption trends.

cs.NI↗

arXiv2026

xDevSM: An Open-Source Framework for Portable, AI-Ready xApps Across Heterogeneous O-RAN Deployments

Openness and programmability in the O-RAN architecture enable closed-loop control of the Radio Access Network (RAN). Artificial Intelligence (AI)-driven xApps, in the near-real-time RAN Intelligent Controller (RIC), can learn from network data, anticipate future conditions, and dynamically adapt radio configurations. However, their development and adoption are hindered by the complexity of low-level RAN control and monitoring message models exposed over the O-RAN E2 interface, limited interoperability across heterogeneous RAN software stacks, and the lack of developer-friendly frameworks. In this paper, we introduce xDevSM, a framework that significantly lowers the barrier to xApp development by unifying observability and control in O-RAN deployment. By exposing a rich set of Key Performance Measurements (KPMs) and enabling fine-grained radio resource management controls, xDevSM provides the essential foundation for practical AI-driven xApps. We validate xDevSM on real-world testbeds, leveraging Commercial Off-the-Shelf (COTS) devices together with heterogeneous RAN hardware, including Universal Software Radio Peripheral (USRP)-based Software-defined Radios (SDRs) and Foxconn radio units, and show its seamless interoperability across multiple open-source RAN software stacks. Furthermore, we discuss and evaluate the capabilities of our framework through three O-RAN-based scenarios of high interest: (i) KPM-based monitoring of network performance, (ii) slice-level Physical Resource Block (PRB) allocation control across multiple User Equipments (UEs) and slices, and (iii) mobility-aware handover control, showing that xDevSM can implement intelligent closed-loop applications, laying the groundwork for learning-based optimization in heterogeneous RAN deployments. xDevSM is open source and available as foundational tool for the research community.

cs.NI↗

arXiv2026

AgentRAN: An Agentic AI Architecture for Autonomous Control of Open 6G Networks

Despite the programmable architecture of Open RAN, today's deployments still rely heavily on static control and manual operations. To move beyond this limitation, we introduce AgentRAN, an AI-native, Open RAN-aligned agentic framework that generates and orchestrates a fabric of distributed AI agents based on natural language intents. Unlike traditional approaches that require explicit programming, AgentRAN's LLM-powered agents interpret natural language intents, negotiate strategies through structured conversations, and orchestrate control loops across the network. AgentRAN instantiates a self-organizing hierarchy of agents that decompose complex intents across time scales (from sub-millisecond to minutes), spatial domains (cell to network-wide), and protocol layers (PHY/MAC to RRC). A central innovation is the AI-RAN Factory, which continuously generates improved agents and algorithms from operational data, transforming the network into a system that evolves its own intelligence. We validate AgentRAN through live 5G experiments, demonstrating dynamic adaptation to changing operator intents across power control and scheduling. Key benefits include transparent decision-making (all agent reasoning is auditable), bootstrapped intelligence (no initial training data required), and continuous self-improvement via the AI-RAN Factory.

cs.AI↗

arXiv2026

SIA: Symbolic Interpretability for Anticipatory Deep Reinforcement Learning in Network Control

Deep reinforcement learning (DRL) promises adaptive control for future mobile networks but conventional agents remain reactive: they act on past and current measurements and cannot leverage short-term forecasts of exogenous KPIs such as bandwidth. Augmenting agents with predictions can overcome this temporal myopia, yet uptake in networking is scarce because forecast-aware agents act as closed-boxes; operators cannot tell whether predictions guide decisions or justify the added complexity. We propose SIA, the first interpreter that exposes in real time how forecast-augmented DRL agents operate. SIA fuses Symbolic AI abstractions with per-KPI Knowledge Graphs to produce explanations, and includes a new Influence Score metric. SIA achieves sub-millisecond speed, over 200x faster than existing XAI methods. We evaluate SIA on three diverse networking use cases, uncovering hidden issues, including temporal misalignment in forecast integration and reward-design biases that trigger counter-productive policies. These insights enable targeted fixes: a redesigned agent achieves a 9% higher average bitrate in video streaming, and SIA's online Action-Refinement module improves RAN-slicing reward by 25% without retraining. By making anticipatory DRL transparent and tunable, SIA lowers the barrier to proactive control in next-generation mobile networks.

cs.NI↗

arXiv2026

MANATEE: A DevOps Platform for xApp Lifecycle Management and Testing in Open RAN

The shift to disaggregated 5G architectures introduces unprecedented flexibility but also significant complexity in Beyond 5G Radio Access Networks (RANs). Open RAN enables programmability through xApps, yet deploying and validating these applications is critical given the nature of the systems they aim to control. Current Open RAN ecosystems lack robust lifecycle management of xApps that enable automated testing, seamless migration, and production-grade observability, resulting in slow, error-prone xApp delivery. To address these issues, DevOps practices can streamline the xApp lifecycle by integrating Continuous Integration/Continuous Deployment (CI/CD) pipelines with advanced traffic management and monitoring, such as leveraging service mesh technologies to enable progressive deployment strategies (e.g., canary releases and A/B testing) to ensure fine-grained observability and resilience. The solution presented in this article, MANATEE (Mesh Architecture for Radio Access Network Automation and TEsting Ecosystems), is the first platform that combines these principles to simplify xApp delivery into production, accelerate innovation, and guarantee performance across heterogeneous O-RAN environments. We prototyped MANATEE on a Kubernetes cluster integrated with the O-RAN Software Community Near-Real Time RAN Intelligent Controller (RIC), as well as with service mesh technologies, to facilitate testing of xApps across simulated, emulated, and real testbed environments. Our experimental results demonstrate that service mesh integration introduces minimal overhead (below 1 ms latency), while enabling reliable canary deployments with fine-grained traffic control and conflict-free A/B testing through circuit-breaking mechanisms.

cs.NI↗

arXiv2025

AutoRAN: Automated and Zero-Touch Open RAN Systems

[...] This paper presents AutoRAN, an automated, intent-driven framework for zero-touch provisioning of open, programmable cellular networks. Leveraging cloud-native principles, AutoRAN employs virtualization, declarative infrastructure-as-code templates, and disaggregated micro-services to abstract physical resources and protocol stacks. Its orchestration engine integrates Language Models (LLMs) to translate high-level intents into machine-readable configurations, enabling closed-loop control via telemetry-driven observability. Implemented on a multi-architecture OpenShift cluster with heterogeneous compute (x86/ARM CPUs, NVIDIA GPUs) and multi-vendor Radio Access Network (RAN) hardware (Foxconn, NI), AutoRAN automates deployment of O-RAN-compliant stacks-including OpenAirInterface, NVIDIA ARC RAN, Open5GS core, and O-RAN Software Community (OSC) RIC components-using CI/CD pipelines. Experimental results demonstrate that AutoRAN is capable of deploying an end-to-end Private 5G network in less than 60 seconds with 1.6 Gbps throughput, validating its ability to streamline configuration, accelerate testing, and reduce manual intervention with similar performance than non cloud-based implementations. With its novel LLM-assisted intent translation mechanism, and performance-optimized automation workflow for multi-vendor environments, AutoRAN has the potential of advancing the robustness of next-generation cellular supply chains through reproducible, intent-based provisioning across public and private deployments.

cs.NI↗

arXiv2025

Beyond Connectivity: An Open Architecture for AI-RAN Convergence in 6G

Data-intensive Artificial Intelligence (AI) applications at the network edge demand a fundamental shift in Radio Access Network (RAN) design, from merely consuming AI for network optimization, to actively enabling distributed AI workloads. This presents a significant opportunity for network operators to monetize AI while leveraging existing infrastructure. To realize this vision, this article presents a novel converged O-RAN and AI-RAN architecture for unified orchestration and management of telecommunications and AI workloads on shared infrastructure. The proposed architecture extends the Open RAN principles of modularity, disaggregation, and cloud-nativeness to support heterogeneous AI deployments. We introduce two key architectural innovations: (i) the AI-RAN Orchestrator, which extends the O-RAN Service Management and Orchestration (SMO) to enable integrated resource and allocation across RAN and AI workloads; and (ii) AI-RAN sites that provide distributed edge AI platforms with real-time processing capabilities. The proposed architecture enables flexible orchestration, meeting requirements for managing heterogeneous workloads at different time scales while maintaining open, standardized interfaces and multi-vendor interoperability.

cs.NI↗

arXiv2025

TIMESAFE: Timing Interruption Monitoring and Security Assessment for Fronthaul Environments

5G and beyond cellular systems embrace the disaggregation of Radio Access Network (RAN) components, exemplified by the evolution of the fronthaul (FH) connection between cellular baseband and radio unit equipment. Crucially, synchronization over the FH is pivotal for reliable 5G services. In recent years, there has been a push to move these links to an Ethernet-based packet network topology, leveraging existing standards and ongoing research for Time-Sensitive Networking (TSN). However, TSN standards, such as Precision Time Protocol (PTP), focus on performance with little to no concern for security. This increases the exposure of the open FH to security risks. Attacks targeting synchronization mechanisms pose significant threats, potentially disrupting 5G networks and impairing connectivity. In this paper, we demonstrate the impact of successful spoofing and replay attacks against PTP synchronization. We show how a spoofing attack is able to cause a production-ready O-RAN and 5G-compliant private cellular base station to catastrophically fail within 2 seconds of the attack, necessitating manual intervention to restore full network operations. To counter this, we design a Machine Learning (ML)-based monitoring solution capable of detecting various malicious attacks with over 97.5% accuracy.

cs.NI↗

arXiv2025

dApps: Enabling Real-Time AI-Based Open RAN Control

Open Radio Access Networks (RANs) leverage disaggregated and programmable RAN functions and open interfaces to enable closed-loop, data-driven radio resource management. This is performed through custom intelligent applications on the RAN Intelligent Controllers (RICs), optimizing RAN policy scheduling, network slicing, user session management, and medium access control, among others. In this context, we have proposed dApps as a key extension of the O-RAN architecture into the real-time and user-plane domains. Deployed directly on RAN nodes, dApps access data otherwise unavailable to RICs due to privacy or timing constraints, enabling the execution of control actions within shorter time intervals. In this paper, we propose for the first time a reference architecture for dApps, defining their life cycle from deployment by the Service Management and Orchestration (SMO) to real-time control loop interactions with the RAN nodes where they are hosted. We introduce a new dApp interface, E3, along with an Application Protocol (AP) that supports structured message exchanges and extensible communication for various service models. By bridging E3 with the existing O-RAN E2 interface, we enable dApps, xApps, and rApps to coexist and coordinate. These applications can then collaborate on complex use cases and employ hierarchical control to resolve shared resource conflicts. Finally, we present and open-source a dApp framework based on OpenAirInterface (OAI). We benchmark its performance in two real-time control use cases, i.e., spectrum sharing and positioning in a 5th generation (5G) Next Generation Node Base (gNB) scenario. Our experimental results show that standardized real-time control loops via dApps are feasible, achieving average control latency below 450 microseconds and allowing optimal use of shared spectral resources.

cs.NI↗

arXiv2025

On AI Verification in Open RAN

Open RAN introduces a flexible, cloud-based architecture for the Radio Access Network (RAN), enabling Artificial Intelligence (AI)/Machine Learning (ML)-driven automation across heterogeneous, multi-vendor deployments. While EXplainable Artificial Intelligence (XAI) helps mitigate the opacity of AI models, explainability alone does not guarantee reliable network operations. In this article, we propose a lightweight verification approach based on interpretable models to validate the behavior of Deep Reinforcement Learning (DRL) agents for RAN slicing and scheduling in Open RAN. Specifically, we use Decision Tree (DT)-based verifiers to perform near-real-time consistency checks at runtime, which would be otherwise unfeasible with computationally expensive state-of-the-art verifiers. We analyze the landscape of XAI and AI verification, propose a scalable architectural integration, and demonstrate feasibility with a DT-based slice-verifier. We also outline future challenges to ensure trustworthy AI adoption in Open RAN.

cs.NI↗

arXiv2025

X5G: An Open, Programmable, Multi-vendor, End-to-end, Private 5G O-RAN Testbed with NVIDIA ARC and OpenAirInterface

As Fifth generation (5G) cellular systems transition to softwarized, programmable, and intelligent networks, it becomes fundamental to enable public and private 5G deployments that are (i) primarily based on software components while (ii) maintaining or exceeding the performance of traditional monolithic systems and (iii) enabling programmability through bespoke configurations and optimized deployments. This requires hardware acceleration to scale the Physical (PHY) layer performance, programmable elements in the Radio Access Network (RAN) and intelligent controllers at the edge, careful planning of the Radio Frequency (RF) environment, as well as end-to-end integration and testing. In this paper, we describe how we developed the programmable X5G testbed, addressing these challenges through the deployment of the first 8-node network based on the integration of NVIDIA Aerial RAN CoLab Over-the-Air (ARC-OTA), OpenAirInterface (OAI), and a near-real-time RAN Intelligent Controller (RIC). The Aerial Software Development Kit (SDK) provides the PHY layer, accelerated on Graphics Processing Unit (GPU), with the higher layers from the OAI open-source project interfaced with the PHY through the Small Cell Forum (SCF) Functional Application Platform Interface (FAPI). An E2 agent provides connectivity to the O-RAN Software Community (OSC) near-real-time RIC. We discuss software integration, network infrastructure, and a digital twin framework for RF planning. We then profile the performance with up to 4 Commercial Off-the-Shelf (COTS) smartphones for each base station with iPerf and video streaming applications, as well as up to 25 emulated User Equipments (UEs), measuring a cell rate higher than 1.65 Gbps in downlink and 143 Mbps in uplink.

cs.NI↗

arXiv2025

TailO-RAN: O-RAN Control on Scheduler Parameters to Tailor RAN Performance

The traditional black-box and monolithic approach to Radio Access Networks (RANs) has heavily limited flexibility and innovation. The Open RAN paradigm, and the architecture proposed by the O-RAN ALLIANCE, aim to address these limitations via openness, virtualization and network intelligence. In this work, first we propose a novel, programmable scheduler design for Open RAN Distributed Units (DUs) that can guarantee minimum throughput levels to User Equipments (UEs) via configurable weights. Then, we propose an O-RAN xApp that reconfigures the scheduler's weights dynamically based on the joint Complementary Cumulative Distribution Function (CCDF) of reported throughput values. We demonstrate the effectiveness of our approach by considering the problem of asset tracking in 5G-powered Industrial Internet of Things (IIoT) where uplink video transmissions from a set of cameras are used to detect and track assets via computer vision algorithms. We implement our programmable scheduler on the OpenAirInterface (OAI) 5G protocol stack, and test the effectiveness of our xApp control by deploying it on the O-RAN Software Community (OSC) near-RT RAN Intelligent Controller (RIC) and controlling a 5G RAN instantiated on the Colosseum Open RAN digital twin. Our experimental results demonstrate that our approach enhances the success percentage of meeting throughput requirements by 33% compared to a reference scheduler. Moreover, in the asset tracking use case, we show that the xApp improves the detection accuracy, i.e., the F1 score, by up to 37.04%.

cs.NI↗

arXiv2025

CORMO-RAN: Lossless Migration of xApps in O-RAN

Open Radio Access Network (RAN) is a key paradigm to attain unprecedented flexibility of the RAN via disaggregation and Artificial Intelligence (AI)-based applications called xApps. In dense areas with many active RAN nodes, compute resources are engineered to support potentially hundreds of xApps monitoring and controlling the RAN to achieve operator's intents. However, such resources might become underutilized during low-traffic periods, where most cells are sleeping and, given the reduced RAN complexity, only a few xApps are needed for its control. In this paper, we propose CORMO-RAN, a data-driven orchestrator that dynamically activates compute nodes based on xApp load to save energy, and performs lossless migration of xApps from nodes to be turned off to active ones while ensuring xApp availability during migration. CORMO-RAN tackles the trade-off among service availability, scalability, and energy consumption while (i) preserving xApps' internal state to prevent RAN performance degradation during migration; (ii) accounting for xApp diversity in state size and timing constraints; and (iii) implementing several migration strategies and providing guidelines on best strategies to use based on resource availability and requirements. We prototype CORMO-RAN as an rApp, and experimentally evaluate it on an O-RAN private 5G testbed hosted on a Red Hat OpenShift cluster with commercial radio units. Results demonstrate that CORMO-RAN is effective in minimizing energy consumption of the RAN Intelligent Controller (RIC) cluster, yielding up to 64% energy saving when compared to existing approaches.

cs.NI↗

arXiv2025

PACIFISTA: Conflict Evaluation and Management in Open RAN

The O-RAN ALLIANCE is defining architectures, interfaces, operations, and security requirements for cellular networks based on Open Radio Access Network (RAN) principles. In this context, O-RAN introduced the RAN Intelligent Controllers (RICs) to enable dynamic control of cellular networks via data-driven applications referred to as rApps and xApps. RICs enable for the first time truly intelligent and self-organizing cellular networks. However, enabling the execution of many Artificial Intelligence (AI) algorithms making autonomous control decisions to fulfill diverse (and possibly conflicting) goals poses unprecedented challenges. For instance, the execution of one xApp aiming at maximizing throughput and one aiming at minimizing energy consumption would inevitably result in diametrically opposed resource allocation strategies. Therefore, conflict management becomes a crucial component of any functional intelligent O-RAN system. This article studies the problem of conflict mitigation in O-RAN and proposes PACIFISTA, a framework to detect, characterize, and mitigate conflicts generated by O-RAN applications that control RAN parameters. PACIFISTA leverages a profiling pipeline to tests O-RAN applications in a sandbox environment, and combines hierarchical graphs with statistical models to detect the existence of conflicts and evaluate their severity. Experiments on Colosseum and OpenRAN Gym demonstrate PACIFISTA's ability to predict conflicts and provide valuable information before conflicting xApps are deployed on production. We demonstrate that users can experience a 16% throughput loss even in the case of xApps with similar goals, and that applications with conflicting goals might cause instability and result in up to 30% performance degradation. We also show that PACIFISTA can help operators to identify conflicting applications and maintain performance degradation at bay.

cs.NI↗

arXiv2025

Driving Innovation in 6G Wireless Technologies: The OpenAirInterface Approach

The development of 6G wireless technologies is rapidly advancing, with the 3rd Generation Partnership Project (3GPP) entering the pre-standardization phase and aiming to deliver the first specifications by 2028. This paper explores the OpenAirInterface (OAI) project, an open-source initiative that plays a crucial role in the evolution of 5G and future 6G networks. OAI provides a comprehensive implementation of 3GPP and O-RAN compliant networks, including Radio Access Network (RAN), Core Network (CN), and software-defined User Equipment (UE) components. This paper details the history and evolution of OAI, its licensing model, and the various projects under its umbrella, such as RAN, the CN, and the Operations, Administration and Maintenance (OAM) projects. It also highlights the development methodology, Continuous Integration/Continuous Delivery (CI/CD) processes, and end-to-end systems powered by OAI. Furthermore, the paper discusses the potential of OAI for 6G research, focusing on spectrum, reflective intelligent surfaces, and Artificial Intelligence (AI)/Machine Learning (ML) integration. The open-source approach of OAI is emphasized as essential for tackling the challenges of 6G, fostering community collaboration, and driving innovation in next-generation wireless technologies.

cs.NI↗