"From Description to Detection: LLM based Extendable O-RAN Compliant Blind DoS Detection in 5G and Beyond"

This repo contains the artefacts for paper "From Description to Detection: LLM based Extendable O-RAN Compliant Blind DoS Detection in 5G and Beyond"

Directory Content

1. AutoEncoder - This directory contains the artefacts to run the Blind DoS attack detection with AutoEncoder model
2. Desc2Det - This directory contains the artefacts to generate Blind DoS attack descriptions from the given attack extract and to run detection using generated descriptions
3. LlmBD-xApp - This is the working xApp, which integrates the full design. It retrieve messages from the SDL and then do the preprocessing and do the detection
4. data - This contains all the data files that we used for experiments

How to Run

1. Replace <HF TOKEN> in detection_script.py file with the huggingface access token. Note that this access token must be subscribe to Llama-3.1-8B-Instruct version or any other model that you want to try
2. Install all the dependecies (vLLM, transformers, torch, pandas, numpy, numpy, scikit-learn)
3. Then run like a normal python script e.g. python3 detection_script.py
4. By default this will run the detection for Blind DoS attack. You can pass a command line argument to change the attack type e.g. python3 detection_script.py null
5. Other support attacks null, ddos, dimsi, hypo

Publication

Please cite our research papers if you develop any products and prototypes based on work:

@misc{Desc2Det,
  title        = {From Description to Detection: LLM based Extendable O‑RAN Compliant Blind DoS Detection in 5G and Beyond},
  author       = {Thusitha Dayaratne and Ngoc Duy Pham and Viet Vo and Shangqi Lai and Sharif Abuadbba and Hajime Suzuki and Xingliang Yuan and Carsten Rudolph},
  year         = {2025},
  eprint       = {arXiv:2510.06530},
  archivePrefix = {arXiv},
  primaryClass = {cs.CR},
  note         = {Submitted Oct 2025},
  doi          = {10.48550/arXiv.2510.06530}
}