Base Station PRACH Metrics for Storm Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
PRACH storm attacks are difficult to detect in radio access networks as attackers send preambles compliant with standards, overwhelming legitimate devices and consuming resources, leading to service denial and financial losses.
Innovation Solution
A method and apparatus for detecting PRACH storm attacks by analyzing metrics such as the number of successfully decoded RRC connection requests and detected preambles, using clustering and correlation analysis of signal parameters to identify suspicious activity, and adjusting radio cell coverage to confirm and mitigate the attack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attackers send preambles compliant with standards through PRACH, then the attack becomes difficult to detect, but the service denial and resource consumption increase
Solution Approach 1:
The system performs preliminary actions by establishing baseline metrics during normal operation (learning phase) before an attack occurs. These baseline values for preamble detection and RRC connection requests are stored and later used for comparison during attack detection, enabling the system to identify anomalies without requiring real-time complex analysis
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring the relationship between detected preambles and successfully decoded RRC connection requests. When the ratio deviates from expected patterns (indicating potential attack), the system triggers alarm conditions and can adjust PRACH configuration parameters to mitigate the attack while maintaining service for legitimate users
2Reliability
If the base station processes all detected preambles through full RA procedures, then connection establishment is ensured, but resource consumption and CPU load increase during attacks
Solution Approach 1:
The system applies partial action by not processing all detected preambles through complete RA procedures. Instead, it uses metric comparison to identify suspicious patterns and selectively triggers full processing only for legitimate connections, while filtering out attack traffic early in the process based on statistical anomalies in preamble-to-connection ratios
Solution Approach 2:
The system performs preliminary filtering by comparing detected preamble counts against baseline values established during the learning phase. This preliminary action identifies potential attacks before full RA procedures are initiated, allowing the system to conserve resources by preventing unnecessary processing of malicious preambles
3Reliability
If the base station reduces radio cell coverage to mitigate attack, then attack impact is reduced, but legitimate device connectivity may be affected
Solution Approach 1:
The system applies local quality by adjusting PRACH configuration parameters (such as rootZadoffChuSequence, cyclicShift, or timeFrequencyStructure) specifically for affected cells or beams rather than globally. This localized adjustment mitigates attacks in specific directions or areas while maintaining normal service coverage for legitimate users in unaffected areas
Solution Approach 2:
The system implements dynamic adjustment of radio cell coverage parameters based on real-time attack detection. When attacks are detected, the base station can dynamically modify PRACH configuration to reduce coverage in attack-directions temporarily, then restore normal coverage when the attack subsides, making the system adaptive to changing attack conditions
Data Source
AI summary
A method for a physical random access channel (PRACH) attack detection includes detecting by a base station a plurality of preambles sent by devices through a PRACH; launching by the base station a random access (RA) procedure for at least one device for which a preamble has been detected; decoding by the base station at least one radio resource control (RRC) connection request received in the context of a launched RA procedure; determining by the base station a first metric and a second metric, wherein the first metric is the number of RRC connection requests successfully decoded over time, wherein the second metric is the number of preambles detected over the same time and for which a RA procedure has been launched; determining whether there is a suspicion of storm attack over the PRACH based on a result of a comparison of the first and second metrics.