Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2611.07225

PRB Starvation at Slot Time via Rank Indicator Inflation: Attacking Proportional Fair Memory in the Scheduler

Ryan Barker·Julia Boone·Tolunay Seyfi·Alirez Ebrahimi·Ethan Farquhar·Brian Davis·Joseph Boccuzzi·Fatemeh Afghah
View original source ↗Read source document ↗Export metadata ↓

Abstract

Proportional fair (PF) scheduling in fifth-generation (5G) New Radio (NR) ranks user equipment (UE) by instantaneous rate over an exponentially weighted moving average (EWMA) of delivered service. We identify a served-but-undelivered denial-of-service (DoS) attack in which rank indicator (RI) inflation induces persistent physical resource block (PRB) starvation. Unsupported spatial layers cause first-attempt delivery failure, keeping the attacker's service EWMA low; the evaluated PF allocator repeatedly grants it the full PRB pool, denying honest UEs transmission opportunities. We formalize this recurrence and evaluate it in 3,300 paired, 200 slot multi-user shards spanning rank 1 and rank 2 Sionna Ray Tracing geometries, three link adaptation controllers, PF and round robin (RR), four target identities, and five seeds. On the rank 2 geometry, selective RI inflation yields 94--95\% target capture, reduces PRB Jain fairness from 0.997 to 0.28, and produces mean honest zero-grant runs of 41--56\,ms; RR preserves equal allocation. Exact offline replay and a Monte Carlo recurrence isolate the delivered-service denominator as the causal path. Cross-field and controller ablations show a weaker, controller-dependent channel-quality trigger, while activity-gated EWMA defenses remain structurally blind. The results motivate RI-consistency checks before feedback acquires scheduling authority and slot-time PRB evidence inside the O-RAN Distributed Unit.

Explore related subjects

cs.NI

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Ryan Barker, Julia Boone, Tolunay Seyfi, Alirez Ebrahimi, Ethan Farquhar, Brian Davis, Joseph Boccuzzi, Fatemeh Afghah. 2026-11-04. PRB Starvation at Slot Time via Rank Indicator Inflation: Attacking Proportional Fair Memory in the Scheduler. https://arxiv.org/abs/2611.07225

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Worst-Case Discovery and Runtime Protection for RL-Based Network Controllers

RL-based controllers achieve strong average-case performance in networking tasks such as congestion control and adaptive bitrate streaming. Yet their performance can degrade severely under network conditions where strong performance is still achievable. Identifying such conditions and quantifying the resulting performance gap is intractable by enumeration, while the sequential and closed-loop nature of RL controllers makes formal verification methods impractical. We present ReGuard, a framework that discovers worst-case scenarios for a given RL controller and protects it against them at inference time without retraining. ReGuard formulates scenario discovery as a bilevel regret-maximization problem, certifying a lower bound on the controller's worst-case performance gap. ReGuard then analyzes the discovered counterfactual trajectories and compiles them into lightweight logic rules that intervene only when a risky state is detected, leaving the controller's behavior unchanged otherwise. We evaluate ReGuard across three RL-based network controllers: Pensieve, Sage, and Park. ReGuard discovers scenarios in which each controller suffers a 43-64% performance loss relative to what is achievable under the same conditions. ReGuard exposes performance gaps 57% to 6 times larger than those found by the strongest baselines and shrinks those gaps by 79-85% in its first iteration via lightweight rule-based protection, iteratively driving the remaining gap toward nominal levels. ReGuard's protection extends beyond the scenarios it discovers, improving performance across a wide range of network conditions.

cs.NI↗
arXiv2026

Deep reinforcement learning-based optimization of multi-RAT handovers

A major evolutionary goal and challenge for next-generation wireless systems is seamless multiple radio access technology (multi-RAT) mobility. In a multi-RAT environment, handover decisions must account for both user quality of service and network priorities, including signal quality, resource availability, energy consumption, latency, and security. Although WiFi/cellular mobility is well explored in research and standardization, many conventional handover mechanisms continue to rely primarily on received signal strength. Such decisions may overlook link delay, congestion, and the distinct operating characteristics of heterogeneous RATs. In this work, we present the Reinforced Flexible Multi-RAT Selection framework (ReFlexMRS), a configurable Deep Reinforcement Learning (DRL)-based approach for multi-criteria handover target selection. ReFlexMRS is evaluated using an SDN-enabled multi-RAT testbed. The decision problem is formulated as a Markov Decision Process with a finite action space and is addressed using a Deep Q-Network (DQN) with convolutional layers that extract relationships among network measurement features. The agent is trained offline from collected network observations using reward guided Q-value updates, then used to select handover targets during inference. A 5G-WiFi case study demonstrates that ReFlexMRS can trade a small amount of throughput for substantial improvements in link delay, handover stability, and WiFi offloading. Compared with RSSI-based selection, the proposed formulations retain approximately 90-95% of the baseline throughput while reducing total handovers by up to 18% and WiFi-to-5G handovers by up to 13%, while maintaining the required RSSI levels.

cs.NI↗
arXiv2026

Understanding Self-Supervised Representation Learning for Encrypted Traffic

SSL has been adopted for encrypted traffic classification to learn representations from unlabeled traces and reduce reliance on manual feature engineering. However, recent studies show that data leakage can inflate reported performance and that pretrained models can underperform shallow classifiers once leakage is controlled. These findings raise questions about what information SSL can learn from encrypted traffic and how different pretraining mechanisms exploit this information. In this paper, we systematically investigate these questions by examining the sources of learnable information, the effectiveness of contextual pretraining, alternative self-supervision mechanisms, and the limits of representation learning. We first find that visible protocol fields retain contextual dependencies that are strongest between adjacent bytes, while payload interventions establish the classification value of retained plaintext structure. Guided by these insights, we investigate byte-level contextual learning through ByteBERT and TrafficDCNet, showing that aligning prediction granularity with local dependencies produces more discriminative representations. We further examine cross-view contrastive learning through AlignTraffic and find that complementary supervision improves representation quality beyond contextual prediction alone. Across four public classification tasks, AlignTraffic outperforms shallow learning by 5.97% to 30.70%, with additional evaluations on industrial traffic demonstrating its effectiveness in broader settings. Finally, evaluations on Tor traffic and individual packets reveal limitations when application information is concealed or unevenly distributed. These findings provide a systematic understanding of how observable information and self-supervision mechanisms shape the effectiveness and scope of representation learning for encrypted traffic.

cs.NI↗