Multi-Interface Attack Detection in O-RAN Using MUD Profiles

O-RAN is a mobile network architecture that uses multiple interfaces to exchange information between different network components. These interfaces introduce new attack surfaces, and existing work on O-RAN security typically focuses on a single interface at a time. This thesis addresses the problem of attack detection across all three O-RAN interfaces (E2, O1, and A1) using MUD (Manufacturer Usage Description) profiles. The MUD profiles are generated by combining the results of two approaches. In the first approach, MUD profiles are generated from real network traffic using MUDgee. In the second, Finite State Machines are extracted from O-RAN specifications using an LLM, and then converted into MUD profiles. The profiles obtained from both approaches are then merged to produce a complete MUD profile covering all O-RAN components and interfaces. The final step of the thesis consists of deploying the MUD controllers directly inside the relevant O-RAN components (Near-RT RIC, SMO and Non-RT RIC) and testing them against both normal and attack traffic.