DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR

Image generated by AI

TLDR

• What: DoSQ (Denial of Service Quality) is a cross-layer side-channel attack that passively decodes unencrypted 5G Downlink Control Information (DCI) to predict application-layer Goodput, enabling a slot-aligned reactive jammer to surgically corrupt a victim's Physical Downlink Shared Channel (PDSCH) allocation inside a single 1 ms slot.
• Who's at risk: High-bandwidth, low-latency, or QoE-sensitive applications running on 5G NR (New Radio) deployments (e.g., YouTube Live, URLLC slices, autonomous V2X, and tele-surgery) where physical-layer control metadata is broadcast in the clear.
• Key number: DoSQ drives target application Goodput down by 40% to 50% using an effective slot-level jamming hit-rate of just 2% to 10%, guided by an XGBoost classifier achieving 0.870 precision at the top 1% "attack-now" confidence.

The 3rd Generation Partnership Project (3GPP)’s 5G New Radio (5G NR) standard was built with the promise of supporting mission-critical, low-latency services such as Vehicle-to-Everything (V2X) communications, smart-grid control, and tele-surgery. To deliver these capabilities, modern network slices rely on the implicit assumption that lower-layer control signaling broadcasts do not leak actionable, application-level information.

However, a critical vulnerability exists at the boundary of the physical (PHY) and application layers. In a recent paper, researchers from George Mason University introduce DoSQ, a protocol-aware, cross-layer side-channel attack. DoSQ demonstrates that the plain-text Downlink Control Information (DCI) broadcasted on the Physical Downlink Control Channel (PDCCH) provides a highly predictive side channel. By sniffing and analyzing this metadata, an adversary can run real-time machine learning inference to predict a target's application-layer Goodput and execute targeted, slot-aligned jamming that selectively degrades Quality of Experience (QoE) while evading traditional intrusion detection.

Threat Model

The DoSQ threat model involves a highly surgical, passive-active adversary operating within the coverage area of a target 5G gNodeB (gNB).

Background and Problem Setup

In 5G NR, scheduling decisions are transmitted over the air on the PDCCH using Downlink Control Information (DCI) messages. Because these messages must be decoded rapidly by UEs before receiving their actual data payload on the PDSCH, DCI is broadcast completely unencrypted.

While prior works have exploited unencrypted 5G control planes, they operate under strict structural limitations. The table below highlights how DoSQ differs from existing literature:

The core vulnerability targeted by DoSQ is the layer boundary gap. A traditional physical-layer jammer is blind to application-layer outcomes; it cannot verify if its jamming has caused a video stream to downshift or stall. Conversely, the application layer has no cross-layer telemetry to look down the stack and identify that its throughput drop is due to targeted, low-duty-cycle physical jamming rather than normal congestion. DoSQ bridges this gap, establishing the first empirical, closed-loop radio-to-application side-channel attack.

Methodology

DoSQ's architecture consists of three core pipeline stages that must execute with microsecond-level precision:

[  gNB Broadcasts DCI  ]
          │
          ▼
[ Step 1: Sniffer Decodes DCI ] ──(Extracts PRBs, MCS, SLIV, C-RNTI)
          │
          ▼
[ Step 2: ML Feature Aggregation ] ──(Generates Per-Second Feature Vector)
          │
          ▼
[ Step 3: XGBoost Inference ] ──(Predicts State & Trend: {Low, down}?)
          │
          ▼
[ Step 4: Selective Jammer Trigger ] ──(OFDM-modulated QPSK Jamming on Victim's PRBs)

Step 1: Real-Time Passive Sniffing & DCI Decoding

The attacker's sniffing USRP B210 continuously receives downlink frames. It correlates baseband samples against the Primary and Secondary Synchronization Signals (PSS/SSS) within the SSB to establish frame and slot boundaries. Once synchronized, it decodes the Master Information Block (MIB) and System Information Block 1 (SIB1) to identify the Control Resource Set (CORESET) and active Bandwidth Part (BWP) configurations.

Per slot (1 ms on numerology $\mu = 0$), the sniffer:

1. Demodulates OFDM samples within the PDCCH region.
2. Performs blind decoding over search space candidates, descrambling with the victim's recovered Cell Radio Network Temporary Identifier (C-RNTI).
3. Parses successful DCI payloads to extract the frequency-domain Physical Resource Block (PRB) allocation, the Start and Length Indicator Value (SLIV) for OFDM symbol range, and the Modulation and Coding Scheme (MCS) index.

Step 2: The Cross-Layer Inference Model

The sniffer aggregates decoded DCI metadata over 1-second windows to build a feature vector containing:

• Mean and variance of the assigned PRB count.
• Mean and variance of the MCS index.
• Scheduling rate (the fraction of slots in which the victim was allocated resources).
• Mean assigned symbol count and derived mean per-slot PDSCH payload size.
• Temporal context features calculated over preceding historical windows.

This feature vector is fed to a multi-head tree-ensemble classifier (specifically XGBoost).

• State Head: A three-class classifier predicting absolute Goodput tiers: High ($\ge 7$ Mbps, matching sustainable 1080p), Med ($3.5$ to $7$ Mbps, matching 720p), and Low ($< 3.5$ Mbps, matching sub-720p/stalling).
• Trend Head: A binary classifier predicting the immediate Goodput trajectory: up or down.

Step 3: Slot-Bounded Reactive Jamming

If the decoded DCI's C-RNTI matches the target victim, the sniffer instantly sends an inter-process communication (IPC) notification over a ZeroMQ PUSH/PULL channel to the jammer thread. The jammer synthesizes a localized OFDM waveform mapped specifically to the victim’s assigned PRBs and SLIV-determined symbols. It populates these resource elements with pseudorandom QPSK symbols, driving the Signal-to-Interference-plus-Noise Ratio (SINR) below the gNB's selected MCS demodulation threshold.

The Microsecond Timing Budget

The entire decode-to-transmit loop must complete within the same 1 ms slot. If the loop overruns, the jamming signal spills into adjacent slots, ruining target selectivity and increasing the probability of detection.

As defined in Section IV-A-2, the total latency budget is:

Where:

• $T_{decode}$: Latency from first PDCCH sample to successful DCI correlation.
• $T_{notify}$: IPC transfer latency over ZeroMQ.
• $T_{waveform}$: Jamming waveform synthesis cost.
• $T_{uhd}$: UHD host-to-FPGA timed-transmit scheduling latency.

Step-by-Step Attack Algorithm

Below is the procedural workflow executed by DoSQ during active operations:

# DoSQ Closed-Loop Attack Controller
# Runs continuously on the attacker host PC connected to Sniffer & Jammer SDRs

import zmq
import numpy as np

def run_dosq_attack_loop(target_crnti, xgboost_model, setpoint_policy):
    context = zmq.Context()
    sniffer_pull = context.socket(zmq.PULL)
    sniffer_pull.bind("ipc:///tmp/dosq_dci")
    
    # Active Jammer Control Parameters
    hit_rate = 0.0  # H in [0.0, 1.0]
    
    while True:
        # Step 1: Extract sliding window of DCI features
        dci_window = collect_one_second_window(sniffer_pull)
        if not dci_window:
            continue
            
        feature_vector = aggregate_dci_features(dci_window, target_crnti)
        
        # Step 2: Cross-Layer Inference
        pred_state = xgboost_model.state_head.predict(feature_vector)  # {High, Med, Low}
        pred_trend = xgboost_model.trend_head.predict(feature_vector)  # {up, down}
        confidence = xgboost_model.predict_proba(feature_vector)
        
        # Step 3: Run Setpoint Closed-Loop Policy
        # Escalate H if target is not degraded, hold steady once confirmed degraded
        if confidence >= setpoint_policy.confidence_threshold:
            if pred_state != "Low" or pred_trend == "up":
                hit_rate = min(hit_rate + 0.05, 0.10) # Escalate up to 10% limit
            elif pred_state == "Low" and pred_trend == "down":
                hit_rate = max(hit_rate - 0.01, 0.02) # Sustain at minimal energy (2%)
        
        # Step 4: Dispatch hit_rate H to active slot-aligned jamming thread
        update_jammer_hit_rate(hit_rate)

Key Results

Classifier Performance

The XGBoost model was evaluated under two rigorous protocols: Leave-One-Batch-Out (LOBO) to test temporal stability, and Leave-One-Regime-Out (LORO) to evaluate generalization to unseen jamming duty cycles.

As shown in Figure 3 and Figure 4, XGBoost substantially outperforms statistical baselines:

At the critical operation point where the closed-loop controller executes an action ($k = 1\%$ top confidence), the classifier achieves a joint setpoint precision of 0.870, representing a 4.21× lift over the base rate of 0.207.

End-to-End Timing Benchmarks

Table II reports empirical host-side timing measurements across $N = 3,933$ consecutive slots on commodity USRP B210 hardware:

Even at the 99th percentile ($383.4\ \mu$s), the entire pipeline completes well within the 1 ms (1000$\mu$s) slot boundary. This leaves roughly 57% of the slot duration (the remaining 8 OFDM symbols of the PDSCH) completely open to receive targeted jamming.

Closed-Loop System Evaluation

When evaluating the real-world impact on YouTube Live on a private 5G NR testbed (Figure 6):

• Unjammed Baseline: Both the victim and a co-located non-target UE stream normally at a Goodput of 10-11 Mbps.
• Active Jamming ($H = 2\%$): The victim's Goodput begins a steep decline within seconds, while the non-target UE remains unaffected.
• Escalated Jamming ($H = 5\%$ to $10%$): The victim's Goodput stabilizes in the 5 to 7 Mbps range—representing a 40% to 50% performance drop—forcing resolution downshifts and buffering. The co-located non-target UE continues to operate with zero observable degradation.

Limitations & Open Questions

While DoSQ presents a serious security risk, critical analysis reveals several real-world bottlenecks:

1. Numerology Scaling Limits: The authors conducted their evaluation on FDD Band n71 using Subcarrier Spacing (SCS) of 15 kHz ($\mu = 0$), yielding a 1 ms slot. If the network moves to higher subcarrier spacing (which compresses slot and symbol durations), the timing constraints on host-side processing become significantly tighter, making same-slot jamming harder without running the DSP pipeline entirely on FPGA fabrics.
2. Sniffing Channel Quality Assumptions: The attack assumes a near-ideal line-of-sight (LoS) or high signal-to-noise ratio (SNR) channel between the gNB and the sniffer to guarantee error-free PDCCH decoding. In highly shadowed or non-LoS urban environments, the sniffer's DCI decoding rate may drop, causing missed slot-allocation alignments and leading to failed attacks.
3. Application Generalizability: The model was evaluated solely against YouTube Live. Although the authors present structural arguments for generalization to other Adaptive Bitrate (ABR) controllers, different commercial platforms utilize distinct buffer depths, congestion-control variants, and transport protocols that may alter the side-channel signature.

What Practitioners Should Do

Defending against DoSQ requires mitigating either the predictability of the side channel or the timing precision of the attacker.

1. Deploy SSB Frequency-Time-Hopping

The most viable defense proposed is to randomize the 5G Synchronization Signal Block (SSB) parameters.

• By dynamically changing the $k_{SSB}$ parameter (which controls frequency offset) and the time-position within a 5 ms half-frame via a pseudo-random sequence, the gNB forces an attacker to brute-force the synchronization grid.
• This expands the synchronization search space to:

This intervention extends the expected re-synchronization time from $\sim 10$ ms to $\approx 10^5$ seconds (approx. 27 hours), effectively breaking the slot-aligned timing synchronization loop necessary for targeted jamming.

2. Address UE Firmware Caching Bottlenecks

To make SSB hopping operationally viable, mobile baseband manufacturers must implement firmware updates. Currently, COTS UEs optimize energy efficiency by caching the $k_{SSB}$ value obtained during initial cell search. If the gNB hops the SSB parameters, the UE’s assumed grid shifts, causing MIB re-decoding to fail and dropping the connection. Baseband firmware must be updated to dynamically track varying $k_{SSB}$ parameters according to a pre-shared pseudo-random sequence key established during RRC connection setup.

The Takeaway

Historically, wireless network design has prioritized physical-layer speed and reliability over metadata confidentiality. DoSQ proves that unencrypted control planes leak high-fidelity side-channel information, allowing resource-constrained adversaries to map lower-layer scheduling metadata directly to application-layer QoE. As we transition toward fully autonomous 5G infrastructure, securing these cross-layer boundaries against targeted, energy-minimal exploits is no longer optional—it is a critical security prerequisite.

Den's Take

What fascinates me about DoSQ is how it shifts the paradigm from blunt-force RF jamming to surgical, intelligence-driven disruption. Instead of screaming over the entire spectrum, the authors use an XGBoost classifier with a highly respectable 0.870 precision (at the top 1% confidence) to sniff unencrypted Downlink Control Information (DCI) and predict application-layer Goodput. Slipping a reactive jammer into a single 1 ms slot to achieve a 40% to 50% Goodput degradation with a mere 2% to 10% hit-rate is incredibly elegant and deeply concerning.

From a practitioner’s lens, this completely breaks the assumption that physical-layer metadata leaks are harmless. For low-cost commodity hardware—just two USRP B210 SDRs and a reference clock—an attacker can selectively degrade mission-critical slices like V2X.

While we often focus on application-layer defenses, higher-level network security log monitoring is completely blind to these sub-millisecond, physical-layer side-channel exploits. Traditional intrusion detection systems simply won't flag a 2% anomaly. If 5G standards continue to broadcast critical control metadata in the clear, low-latency slices will remain fundamentally exposed.