C-RE-ACT: Causal RE-ACTing Agent for O-RAN Forensic Triage

2026-07-28

AI Summary

This work addresses the challenge of distinguishing performance degradation attacks in O-RAN from routine operational events, a task often conflated in practice and currently reliant on inefficient manual triage. To automate root cause analysis and security–operations event classification, the authors propose a ReAct agent framework that integrates causal discovery with graph-based soft prompting. Specifically, a weighted directed acyclic causal graph is first constructed using the Structure-Agnostic Model (SAM), and Graph Isomorphism Networks (GIN) are then employed to generate graph soft prompts that guide a large language model (LLM) in reasoning about causal relationships. Experimental results demonstrate that the true root cause ranks within the top three candidates in 89% of cases; the graph soft prompts substantially improve the LLM’s causal query accuracy from 0.22 to 0.72; and classification accuracy for latency and packet loss anomalies reaches 83% and 84%, respectively.

Abstract

The shift to O-RAN architectures marks a turning point in cellular security, where increased openness and modularity directly translate into a broader attack surface. Among the security threats cataloged by the O-RAN Alliance Working Group 11, performance-degradation attacks constitute the largest class. These attacks induce packet losses and latency spikes that are hard to distinguish from operational events such as misconfigurations, transient congestion, or software regressions. Consequently, upon an adverse incident detection, support engineers must rapidly determine whether to route the corresponding incident ticket to network maintenance or escalate it to security operations. This triage phase represents a critical human-in-the-loop bottleneck in the incident response lifecycle. To address this vulnerability, we introduce C-RE-ACT (Causal RE-ACTing agent), an automated agentic triage framework designed to generate actionable incident reports. C-RE-ACT starts constructing a Weighted Directed Acyclic Graph (WDAG) over O-RAN metrics using the Structural Agnostic Model (SAM). The resulting causal topology is encoded into a continuous soft token via a Graph Isomorphism Network (GIN) aligned with the language space of the Large Language Model (LLM) powering a ReAct agent. We evaluate C-RE-ACT on a physical, O-RAN-compliant testbed across 140 distinct performance-degradation experiments. Empirical results demonstrate the causal ranking isolates the correct root cause within the top three candidates in 89% of instances. Furthermore, graph soft-prompting improves LLM accuracy on causal-topology queries from 0.22 (text-only baseline) to 0.72. The autonomous agent achieves anomaly classification accuracies of 83% for delay anomalies and 84% for packet-loss anomalies.

Problem

• O-RAN
• performance-degradation attacks
• forensic triage
• incident response
• causal inference

Innovation

• Causal Inference
• O-RAN Security
• Graph Soft-Prompting
• ReAct Agent
• Automated Triage