arXiv：cs.AI· Anoop Mishra, Joshua Moore, Aly Sabri Abdalla, Vuk Marojevic·· 22 小时前
AutoSec-RAN：面向 O-RAN 自动化安全分析的规范锚定 LLM 微调
AutoSec-RAN: Specification-Grounded LLM Fine-Tuning for Automated Security Analysis of O-RAN
AI 导读
AutoSec-RAN 通过在 69 份 O-RAN、3GPP 及相关标准文档上两阶段 LoRA 微调 Mistral-7B-Instruct，并结合 RAG 检索，实现 O-RAN 测试的自动化安全分诊。
正文
Abstract:This paper presents AutoSec-RAN, a specification-grounded large language model (LLM) framework for automated security triage of Open Radio Access Network (O-RAN) testing. Unlike approaches relying on static rule sets or privileged access to raw packet captures, AutoSec-RAN fine-tunes Mistral-7B-Instruct through two Low-Rank Adaptation (LoRA) stages over a curated corpus of 69 O-RAN, 3GPP, and adjacent standards documents, then selectively augments inference with retrieval-augmented generation (RAG) over the same specification index. At inference, the model receives only an investigator-style question and a scenario metadata block, simulating an automated analyst operating without raw packet evidence. AutoSec-RAN is validated on a purpose-built 5G/O-RAN testbed across labeled fronthaul distributed denial of service replay scenarios. A Gemma-4-31B judge LLM scores each candidate's answer on faithfulness, correctness, and actionability relative to a reference authored from full packet capture and log evidence. AutoSec-RAN achieves a mean judge overall score of 0.713 across all 313 evaluation items (0.755 restricted to the five supervised taxonomy classes), clearing the 0.70 reporting threshold, and a blended score of 0.778 (0.808 supervised-only) when cosine similarity over Beijing Academy of Artificial Intelligence (BAAI) General Embedding (BGE) is incorporated as a secondary semantic signal. The framework performs strongest on mitigation and threat-model reasoning (with a mean overall of 0.849 and 0.848, respectively) and identifies a measurable gap on the held-out attack-direction class (0.515), a controlled result that exposes a specific training data requirement. These results establish specification-grounded LoRA fine-tuning combined with RAG retrieval as a viable foundation for automated security validation of AI-native O-RAN.
| Comments: | This paper has been accepted in The 14th IEEE Conference on Communications and Network Security (IEEE CNS 2026) |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Signal Processing (eess.SP) |
| Cite as: | arXiv:2610.15995 [cs.CR] |
| (or arXiv:2610.15995v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.15995 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Aly Sabri Abdalla [view email]
[v1]
Sun, 11 Oct 2026 23:54:13 UTC (223 KB)
来源：arXiv：cs.AI · arxiv.org