An O-RAN-Native xApp Framework for Jammer Detection and Geolocation

The Open Radio Access Network (O-RAN) architecture significantly enhances 5G networks by introducing modularity and intelligence through virtualization and open interfaces. While these networks provide advanced capabilities, the wireless medium remains inherently vulnerable to physical-layer (PHY) disruptions, with malicious radio frequency (RF) jamming posing a critical threat to network availability. To address this issue, this paper proposes a novel O-RAN-native architecture for real-time detection, identification, and localization of jamming attacks. Specifically, the proposed methodology leverages the coordination between specialized xApps running on the Near-Real-Time RAN Intelligent Controller (RIC) to perform real-time analysis of Key Performance Measurements (KPMs). The framework is evaluated in ns-O-RAN with a downlink jamming model, in which a wideband jammer of 40–60 dBm EIRP reduces the L3 SINR measured by the UEs, over 30 Monte Carlo realizations per configuration and a jammer-free control. The SINR-based stages detect the attack without false alarms in the jammer-free control runs and identify the affected sector. An interference-power trilateration that combines SINR and RSRP reports then localizes the jammer with a median error of 9–24 m for two jammer positions, four to ten times lower than centroid-based and path-loss trilateration baselines. The steady-state processing time of 0.89 s for 2000 UEs on a single core is within the 1 s control-loop budget of the Near-RT RIC when S-DBSCAN keeps one event per UE per second and the trilateration is initialized from the previous estimate. Note that these are processing times; the end-to-end latency including E2 transport was not measured. This work establishes a robust O-RAN-native framework for real-time PHY-layer jammer identification and geographic localization, thereby transforming standard network telemetry into actionable threat intelligence across multi-vendor deployments.