SAFE-RAN: A Secure, Adversarial-Robust Federated Learning Framework for Collaborative Intrusion Detection in Open RAN Architectures

The disaggregated, multi-vendor architecture of Open Radio Access Networks (O-RAN) introduces significant security vulnerabilities that traditional Intrusion Detection Systems (IDS) cannot adequately address due to challenges in data privacy and coordination. This paper introduces SAFE-RAN, a security framework that leverages Federated Learning (FL) to enable collaborative, privacy-preserving threat detection across the O-RAN landscape. To validate the efficacy of SAFE-RAN, a simulation of realistic Non-IID environment using the 5G-NIDD dataset, where up to 30% of clients were malicious and performed sophisticated data and model poisoning attacks. At its core, SAFE-RAN employs a Trimmed Cosine Aggregation (TCA) algorithm, implemented within the Non-Real-Time RAN Intelligent Controller (Non-RT RIC), which identifies and filters malicious model updates. Experimental results demonstrate that SAFE-RAN maintains a high detection F1-Score of over 96% and neutralizes targeted backdoor attacks, reducing their success rate to just 4.5%, whereas standard FL and other robust baselines fail under the same conditions, with backdoor success rates exceeding 98%. SAFE-RAN offers a practical and scalable solution for establishing computational trust in multi-vendor 5G/6G environments, providing a crucial defense mechanism for the security of disaggregated networks.