DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR

2026-07-17

AI Summary

This work presents the first demonstration of a cross-layer side channel in 5G NR, spanning from the physical to the application layer, and introduces the DoSQ attack. By real-time decoding of Downlink Control Information (DCI), the attacker identifies the physical resource blocks allocated to a target user and precisely injects interference within the same 1 ms slot. Concurrently, a cross-layer machine learning classifier leverages DCI features to infer the target’s application-layer effective throughput state, enabling efficient quality-of-service degradation without decryption. Evaluated on a private 5G testbed, the attack reduces YouTube Live throughput by up to 50% while minimally affecting non-target users. The classifier achieves a precision of 0.87 at the top 1% confidence threshold, representing a 4.21× improvement over the baseline. The paper also proposes an SSB hopping-based defense mechanism that substantially increases the resynchronization cost for attackers.

Abstract

The 3rd Generation Partnership Project (3GPP)'s Fifth Generation New Radio (5G NR) is critical to supporting mission-critical services. However, 5G systems are vulnerable to smart jamming attacks that can propagate to applications running on top of these networks (i.e., cross-layer). The 5G gNB broadcasts resource scheduling information for the legitimate UEs over the air interface, with a prevailing assumption that this surface alone reveals nothing useful about a user device. However, we show that using the Downlink Control Information (DCI) is sufficient to degrade Application layer service quality, i.e., Denial of Service Quality (DoSQ), by inferring the Application layer Goodput (i.e., via side-channel analysis). Therefore, we present DoSQ, a protocol-aware attack that decodes per-slot DCI to inject interference onto the victim UE's Physical Resource Blocks (PRBs) within the same 1 ms slot, while a cross-layer classifier estimates the victim's Goodput state and trend from DCI features alone, without observing a single encrypted byte. Evaluated on a private 5G NR testbed against YouTube Live, DoSQ drives the target's Goodput down by up to 50% at sparse hit-rates, while a co-located non-target UE remains largely unaffected. Moreover, the classifier achieves a precision of 0.87 at the top 1% of attack-now confidence, a 4.21 times lift over the base rate. Furthermore, we propose an SSB frequency-time-hopping countermeasure that increases the attacker's resynchronization cost. The result is the first empirical measurement of a radio-to-application side channel that any protocol-aware adversary can exploit.

Problem

• DoSQ
• side-channel attack
• 5G NR
• cross-layer
• Denial of Service Quality

Innovation

• DoSQ
• side-channel attack
• 5G NR
• cross-layer
• Downlink Control Information