Quantifying the Privacy Posture of Operator-Side 5G/O-RAN Profiles
Study finds 5G/O-RAN pseudonymisation alone does not cut re-identification; generalisation and suppression improve privacy at a utility cost.
Researchers measure residual re-identification risk in operator-side 5G and O-RAN profiles after anonymisation, using k-anonymity, l-diversity, and t-closeness aggregated into a Privacy-Posture Index. Eight transformation configurations are tested on internal PCAP captures and the public Idaho Labs 5GAD corpus against a full quasi-identifier bound and two simulated adversaries. Pseudonymisation alone does not reduce re-identification, while generalising quasi-identifiers, optionally with suppression, does. Suppression-heavy releases retain majority-class utility but lose much minority-class recall, and standard PPI correlates poorly with a partial-knowledge attack.
- Pseudonymisation alone leaves re-identification risk unchanged.
- Generalisation, optionally with suppression, produces the privacy gains.
- Suppression-heavy releases reduce minority-class recall.
- Mean-class-size PPI tracks attacks better than kmin-based PPI.
- Authors call the modest evaluation indicative, not definitive.
- Organizations
- Idaho Labs
From the original article
1 min read at arxiv.orgOperator-side network profiles derived from 5G/ORAN traffic carry personal data such as ephemeral subscriber identifiers, slice-level KPIs, and control-plane signalling, and must be anonymised before release to a federated-learning aggregator, threat-intelligence exchange, or ML training pipeline. We study how much re-identification risk remains after standard operator-side anonymisation.
By Nikolaos Kekatos · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.