Deep Packet Inspection: ORAN Proactive Defense

Modern communication networks are becoming more open, flexible, and interconnected thanks to Open Radio Access Network (ORAN) architectures. This evolution is similar to transforming a closed office into a collaborative open workspace: it improves flexibility and innovation but also requires stronger security controls because more people and systems interact within the same environment.

To balance openness with protection, artificial intelligence is becoming a key enabler. Within the NGCI (Next Generation Communication Infrastructure – our standalone private network), SMA-RTY integrates AI-driven cybersecurity solutions designed to keep networks resilient, reliable, and continuously operational. A central element of this approach is Deep Packet Inspection (DPI), which helps networks identify and stop threats before they can cause disruption.

Current approaches to network protection

Today, network security primarily relies on perimeter defenses, firewalls, and signature-based intrusion detection systems. Operators monitor traffic for known threats and intervene when suspicious activity is detected. While these traditional measures are effective against many common attacks, they tend to be reactive, responding only after a threat has been identified.

  • Perimeter defenses act as the first line of protection, controlling which devices and users can access the network.
  • Firewalls monitor and filter traffic between internal and external networks, blocking unauthorized connections.
  • Signature-based intrusion detection systems focus on specific, predefined attack signatures essentially looking for exact copies of known threats, alerting operators when a match is found.

While these measures are effective against common and previously identified attacks, they are largely reactive and cannot detect new, evolving, or sophisticated threats that do not match existing signatures. This limitation leaves a gap in modern, dynamic networks, where attacks can quickly adapt and bypass traditional defenses.

What Is Deep Packet Inspection and the Role of CNNs

Deep Packet Inspection (DPI) is an advanced method used to analyze network traffic in detail by using Convolutional Neural Networks (CNNs). Traditional monitoring checks only packet headers, similar to reading the address on an envelope. DPI, instead, evaluates how packets are sent, how often they appear, and whether their delivery behavior deviates from the norm—without opening the envelope itself.

What is CNN? It's a class of artificial intelligence models designed to recognize complex patterns. They were originally inspired by biological vision systems, particularly the way the animal visual cortex processes information. In biological vision, neurons respond to stimuli within specific areas of the visual field, allowing the brain to reconstruct images by combining overlapping visual signals. CNNs replicate a similar layered approach, progressively extracting relevant features from data.

Initially developed for image analysis, such as identifying handwritten numbers in financial and document-processing applications, they excel at identifying recurring structures and anomalies within large datasets. Applied to networking, CNNs learn to recognize traffic patterns, distinguishing between legitimate behavior and potential threats with high accuracy.

Unlike traditional algorithms that rely on manually designed filters, CNNs automatically learn which features are most relevant during the training phase. This significantly reduces human intervention while improving scalability and detection accuracy.

SMARTY 5G network architecture

Proactive Defense: How SMA-RTY DPI Operates

SMA-RTY’s DPI continuously monitors network traffic and distinguishes between legitimate and potentially harmful activity in real time. It operates seamlessly within the infrastructure, meaning it works in the background without affecting user experience. This is possible because it has been trained on datasets of known attacks, allowing it to recognize malicious patterns quickly and accurately.

The system constantly checks the type and behavior of traffic flowing through the network. When it detects traffic that does not match expected patterns, it automatically triggers protective measures. These actions include:

  1. stopping the suspicious data session,
  2. placing the source of malicious traffic into a denylist to block further activity,
  3. and adjusting the operational cell frequency to prevent possible exploitation or interference.

The automated response shifts network security from a reactive model to a proactive one. By reducing reliance on manual intervention, operators can maintain service continuity while the network protects itself in real time. At the same time, it guarantees that legitimate users can continue using the network without interruption.

The Technical Architecture: Transforming Network Packets into Computer Vision

The innovation behind SMA-RTY’s DPI system lies in its ability to transform raw network traffic into a two-dimensional spatial representation, effectively treating network data as images. Rather than analyzing packets in isolation, the system aggregates traffic flows into input matrices of size N x F. In this structure, N represents the number of packets collected within a specific time window (fixed at 10 seconds to ensure real-time operation), and F denotes the specific features extracted from each packet. The selected features (F) include critical metadata that preserves user privacy, such as IP packet length, Time-To-Live (TTL), IP flags, and inter-arrival times. These attributes undergo a normalization process to a range of [0, 1], preventing larger numerical values from overwhelming the neural network during training.

At the core of the detection engine is a customized Convolutional Neural Network (CNN) designed for extreme computational efficiency. While standard state-of-the-art computer vision architectures (such as ResNet or Inception) were tested, the study found that a leaner CNN with only three convolutional layers provided superior performance for this specific task. This customized model achieves an F1-score of up to 0.9989 when identifying complex threats like DoS or SYN Flood attacks.

This lightweight architecture is specifically designed to be integrated into the Network Data Analytics Function (NWDAF) at the network edge. By deploying this intelligence directly within the base station, the system can identify and drop malicious packets at the source, preventing them from propagating through the core network and ensuring resilience.

SMARTY 5G network architecture

Intelligence Without Compromise: Privacy by design

A common fear is that deep inspection means "reading the mail." At SMA-RTY, we use a different philosophy. Our DPI focuses on metadata and behavioral anomalies, rather than sensitive content.

Just as one can identify suspicious mailing behavior by observing delivery frequency and routing—without opening envelopes—SMA-RTY DPI evaluates how data flows behave rather than what they contain. By analyzing the structural and behavioral characteristics of data flows, SMA-RTY DPI can autonomously detect and mitigate complex threats while preserving user privacy. This enables the network to respond to security risks without requiring manual intervention, ensuring continuous and reliable connectivity for legitimate users.

Practical Benefits in Tactical Bubbles and Critical Operations

SMA-RTY DPI is particularly valuable in tactical bubbles: temporary or rapidly deployable network environments used in defense, emergency response, industrial operations, or remote missions. These scenarios demand high reliability under dynamic and often hostile conditions.

Key advantages include:

  • Autonomous survivability: the network can drop a malicious session and reconfigure itself in milliseconds.
  • Frequency Agility: By changing frequencies, the tactical bubble becomes a moving target, making it nearly impossible for attackers to pin it down.
  • Seamless Continuity: For legitimate users inside the bubble, the transition is as smooth as a heart skipping a beat, barely noticeable, yet vital for survival.

In these environments, DPI acts as an adaptive security layer that continuously monitors traffic and reacts in real time, ensuring stable and secure communications when they are most critical.

Beyond CNNs: Toward the Next Generation of Resilient Networks

SMA-RTY approaches ORAN resilience as a living system rather than a static defense layer. Instead of relying solely on perimeter protection, the network is equipped with autonomous mechanisms capable of identifying and neutralizing threats as they emerge.

Building on CNN-based intelligence, SMA-RTY is now advancing research into Spike Learning, also known as Spiking Neural Networks. Inspired by biological neural systems, spike learning processes information only when specific thresholds are reached, enabling faster reactions and improved energy efficiency.

This evolution will further enhance DPI capabilities, enabling networks that learn continuously from operational conditions and become increasingly adaptive over time. The result is a more resilient, efficient, and intelligent communication fabric, designed to operate reliably even in highly challenging digital environments.

References

back