Denial of Service Attacks Targeting Layer 2 in 5G RAN

Denial of Service (DoS) attacks on legitimate users using a Fake Base Station (FBS) remain a persistent threat to the integrity and reliability of 5G networks. These attacks exploit gaps in lower-layer authentication procedure by impersonating legitimate base stations, resulting in wastage of radio resources. Traditionally, these attacks and their detection techniques often operate at the Non-Access Stratum (NAS) or Radio Resource Control (RRC) layers, missing the signs of such attacks originating at Layer 2. In this work, we introduce two DoS attacks on Random Access Channel (RACH) and RRC procedures over 5G RAN and study their impact on users. We further introduce a user-side threshold-based FBS detection technique to mitigate the impact of FBS. We demonstrate these DoS attacks and assess the effectiveness of the proposed detection technique on both physical testbed and simulation environments. Attack scenarios, including RACH drop and RRCSetupRequest drop, are emulated to demonstrate the effectiveness of these attacks. The results indicate that the proposed DoS attacks using FBS can significantly drain radio and compute resources, even without going through the registration process. With a threshold-based detection technique, we can minimize the impact of these attacks before they escalate.