Apparatus and Method for Detecting PRACH Storm Attacks

A base station, the base station comprising:

• at least one processor;
• and
• at least one non-transitory memory storing instructions that, when executed with the at least one processor, cause the base station to perform:
• detecting with a base station a plurality of preambles sent with devices through a physical random access channel;
• launching with the base station a random access procedure for at least one device for which a preamble has been detected;
• decoding with the base station at least one radio resource control connection request received in the context of a launched random access procedure;
• determining with the base station a first metric and a second metric, wherein the first metric is the number of radio resource control connection requests successfully decoded over a period of time, wherein the second metric is the number of preambles detected over the same period of time for which a random access procedure has been launched;
• determining whether there is a suspicion of storm attack over the physical random access channel based on a result of a comparison of the first metric with the second metric;
• and
• launching a physical random access channel attack detection process when a suspicion of storm attack is determined.

A non-transitory computer-readable medium storing computer-executable instructions that, when executed with at least one processor at a base station, cause the base station to perform a method comprising:

• detecting with a base station a plurality of preambles sent with devices through a physical random access channel;
• launching with the base station a random access procedure for at least one device for which a preamble has been detected;
• decoding with the base station at least one radio resource control connection request received in the context of a launched random access procedure;
• determining with the base station a first metric and a second metric, wherein the first metric is the number of radio resource control connection requests successfully decoded over a period of time, wherein the second metric is the number of preambles detected over the same period of time for which a random access procedure has been launched;
• determining whether there is a suspicion of storm attack over the physical random access channel based on a result of a comparison of the first metric with the second metric;
• and
• launching a physical random access channel attack detection process when a suspicion of storm attack is determined.