BATS: UAV-assisted ORAN Anomaly Detection

Project Overview

BATS (Behavior-Aware Threat Surveillance) is an anomaly detection framework for UAV-assisted ORAN (Open Radio Access Network) architecture. It monitors control loop and KPI behavior in UAV/edge ORAN systems, detects cyber-physical anomalies and attack patterns, and provides robust model-based decision support.

Core capabilities:

• LSTM autoencoder-based reconstruction and residual anomaly scoring
• Temporal attack simulation for UAV-assisted ORAN control loops
• K/alpha sensitivity sweeps, threshold optimization, and metrics reporting
• Visualization and post-mortem analysis for attack traces

Goals:

• detect injection/targeted attacks in control KPI signals
• evaluate sensitivity by attack intensity/length/k
• produce interpretable graphs, logs, and tables

---

Installation Instructions

To install the required dependencies, follow these steps:

1. Clone the repository:

   git clone https://github.com/NGNLab-Projects/Control_Loop_Anomaly_Detection_Jan2026.git

2. Navigate to the project directory:

   cd Control_Loop_Anomaly_Detection_Jan2026

3. Install dependencies using pip:

   pip install -r requirements.txt

Repository structure

• attack_and_detection

  • Core attack simulation and detection modules
  • lstm_ae.h5, scaler.save: trained model artifacts
  • attack_split.py, compute_temporal_attack.py, detect_with_ai.py: offensive/defensive scenarios
  • lstm_detect.py, lstm_error_line_graph.py, lstm_graphs.py: anomaly scoring + plots
  • k_sweep_results.csv, k_sensitivity_*.txt: detector parameter exploration
  • feature_error.npy, normal_mse.npy, threshold_sweep.py, optimize_threshold.py

• datasets

  • attack / normal KPI CSVs for test/training (cell_kpis_attack.csv, etc.)

• main

  • legacy/main notebooks for experimental scripts and ablation (k_sensitivity.py, isolation.py, alpha_sensitivity.py)

• behavior_modeling

  • LSTM baseline + training and evaluation
  • lstm_baseline.py, lstm_detect.py, train_lstm_ae.py, lstm_seq_builder.py
  • model artifacts (lstm_ae.h5, normal_mse.npy, threshold_3sigma.npy, threshold_5sigma.npy)

• dataset_simulation

  • external simulation data packs (SUMO, network), environment-specific

• eval

  • scoring helpers (adaptive_metrics.py)

• extras

  • support data ingestion / conversion and manual baseline run scripts
  • data_ingestion_attack.py, lstm_training.py, test_batch.py, etc.

• top-level:

  • README.md, Cmds.MD, simulation-Standards.md
  • requirements.txt, requirements-lock.txt

---

Setup and install

1. Clone repo:

   git clone https://github.com/NGNLab-Projects/Control_Loop_Anomaly_Detection_Jan2026.git
   cd final_cip

2. Virtual env (optional/recommended):

   python -m venv venv
   venv\Scripts\activate   # Windows

3. Install dependencies:

   pip install -r requirements.txt

4. (Optional) pin env:

   pip install -r extras/requirements-lock.txt

---

Core pipeline

1. Data prep

• data_ingestion_attack.py or normalize_attack.py
• normalize data + create sequence windows: lstm_seq_builder.py

2. Train LSTM AE

• train_lstm_ae.py (or train_lstm_ae.py)
• Output model:
  • lstm_ae.h5
  • scaler.save
  • normal_mse.npy
  • thresholds.pkl

3. Evaluate + detect

• lstm_detect.py
• produces per-step errors + threshold flags, and standard metrics

4. Attack injection

• compute_temporal_attack.py (temporal attack chain)
• attack_split.py (controlled attack slices)
• output arrays:
  • attack_seq.npy, attack_mse.npy, attack_split.py results

5. Parameter sweep

• attack_and_detection/k_sensitivity.py: sweep k parameter
• attack_and_detection/alpha_sensitivity.py

---

Run examples

(1) Train model in behavior model folder:

cd behavior_modeling
python train_lstm_ae.py

(2) Detect on normal/test data:

python lstm_detect.py --model lstm_ae.h5 --scaler scaler.save --data ../extras/test_normalized.csv

(3) Run attack generation + detection analysis:

cd attack_and_detection
python compute_temporal_attack.py
python detect_with_ai.py --attackFile attack_seq.npy

(4) Sensitivity scan:

python k_sensitivity.py
python alpha_sensitivity.py

(5) Visualization:

python lstm_error_line_graph.py
python lstm_graphs.py

---

Expected outputs / final results

• model weights: *.h5
• scaler: scaler.save
• MSE profiles
  • normal_mse.npy, attack_mse.npy, feature_error.npy
• thresholds:
  • threshold_3sigma.npy, threshold_5sigma.npy
• metrics:
  • k_sweep_results.csv, k_sensitivity_full.txt, alpha_sensitivity_results.txt
• plot images/logs:
  • lstm_graphs.*, lstm_visualization.py outputs
• mitigation / audit:
  • mitigation_log.txt, xai_results.txt

---

Notes

• The repo appears to support both short/long sequence detection and temporal attack patterns.
• Data paths are configured to root folder paths; adjust os.path.join in scripts if your current working directory differs.

---

Troubleshooting

• Import errors: ensure pyyaml, numpy, pandas, tensorflow (or keras), scikit-learn, etc. are installed.
• If model training stalls, reduce batch_size in train_lstm_ae.py.
• For attack artifical injection, check normalize_attack.py output shape to match model input.

---

Quick reference

• Full training + eval workflow: behavior_modeling → attack_and_detection
• Sensitivity tuning: attack_and_detection/*_sensitivity.py
• Robust outputs location:
  • results and root CSVs under attack_and_detection
  • behavior_modeling artifacts

---