FML-AD: A Federated Learning Framework With Meta-Model Refinement for Cyberattack Duration Prediction in 5G O-RAN

The emergence of fifth-generation (5G) and open radio access network (O-RAN) architectures has expanded the attack surface for cyber threats, creating an urgent need for enhanced and proactive mitigation strategies to ensure the preservation of quality of service (QoS), network reliability, and user data privacy in highly distributed and virtualized environments. In this context, we introduce FML-AD, a federated learning framework with meta-model refinement for adaptive attack duration prediction without centralizing raw training traffic. The proposed method combines a FLAD-trained Transformer for distributed temporal learning with an XGBoost-based second-level regression model that refines the initial predictions using controlled O-RAN testbed examples, thereby reducing prediction errors associated with the benchmark-to-deployment distribution shift. Extensive evaluation on the CICIoT2023 dataset shows that FML-AD improves prediction accuracy compared with conventional centralized and federated baselines. Furthermore, an evaluation on a controlled 5G O-RAN testbed involving ten TCP SYN and UDP flooding scenarios provides a proof-of-concept demonstration of the feasibility of the proposed post-detection prediction pipeline in the evaluated configuration. A separate exploratory transfer-learning assessment using 5G V2X radio-jamming scenarios and leave-one-scenario-out (LOSO) validation further examines whether the duration-prediction pipeline can be adapted to a different disruption mechanism under limited target-domain data. For the considered jamming configurations, several operating points in the early 3–5 sec range also produce favorable prediction results, providing preliminary evidence of transferability.