← 研踪 PaperTrailarXiv:2611.07225 · v1
PRB Starvation at Slot Time via Rank Indicator Inflation: Attacking Proportional Fair Memory in the Scheduler
首次提交 2026-11-05 07:29
版本更新 2026-11-05 07:29
雷达观测 2026-11-06 10:04
摘要
Proportional fair (PF) scheduling in fifth-generation (5G) New Radio (NR) ranks user equipment (UE) by instantaneous rate over an exponentially weighted moving average (EWMA) of delivered service. We identify a served-but-undelivered denial-of-service (DoS) attack in which rank indicator (RI) inflation induces persistent physical resource block (PRB) starvation. Unsupported spatial layers cause first-attempt delivery failure, keeping the attacker's service EWMA low; the evaluated PF allocator repeatedly grants it the full PRB pool, denying honest UEs transmission opportunities. We formalize this recurrence and evaluate it in 3,300 paired, 200 slot multi-user shards spanning rank 1 and rank 2 Sionna Ray Tracing geometries, three link adaptation controllers, PF and round robin (RR), four target identities, and five seeds. On the rank 2 geometry, selective RI inflation yields 94--95\% target capture, reduces PRB Jain fairness from 0.997 to 0.28, and produces mean honest zero-grant runs of 41--56\,ms; RR preserves equal allocation. Exact offline replay and a Monte Carlo recurrence isolate the delivered-service denominator as the causal path. Cross-field and controller ablations show a weaker, controller-dependent channel-quality trigger, while activity-gated EWMA defenses remain structurally blind. The results motivate RI-consistency checks before feedback acquires scheduling authority and slot-time PRB evidence inside the O-RAN Distributed Unit.
作者备注：6 pages, 4 figures, 2 tables, IEEE ICEET 979-8-3195-7952-2/26
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-05 07:29 · 最新观测版本
PRB Starvation at Slot Time via Rank Indicator Inflation: Attacking Proportional Fair Memory in the Scheduler
Proportional fair (PF) scheduling in fifth-generation (5G) New Radio (NR) ranks user equipment (UE) by instantaneous rate over an exponentially weighted moving average (EWMA) of delivered service. We identify a served-but-undelivered denial-of-service (DoS) attack in which rank indicator (RI) inflation induces persistent physical resource block (PRB) starvation. Unsupported spatial layers cause first-attempt delivery failure, keeping the attacker's service EWMA low; the evaluated PF allocator repeatedly grants it the full PRB pool, denying honest UEs transmission opportunities. We formalize this recurrence and evaluate it in 3,300 paired, 200 slot multi-user shards spanning rank 1 and rank 2 Sionna Ray Tracing geometries, three link adaptation controllers, PF and round robin (RR), four target identities, and five seeds. On the rank 2 geometry, selective RI inflation yields 94--95\% target capture, reduces PRB Jain fairness from 0.997 to 0.28, and produces mean honest zero-grant runs of 41--56\,ms; RR preserves equal allocation. Exact offline replay and a Monte Carlo recurrence isolate the delivered-service denominator as the causal path. Cross-field and controller ablations show a weaker, controller-dependent channel-quality trigger, while activity-gated EWMA defenses remain structurally blind. The results motivate RI-consistency checks before feedback acquires scheduling authority and slot-time PRB evidence inside the O-RAN Distributed Unit.
查看此版本解读 →查看此版本原文 ↗