DAST framework uses VLM-LLM pipeline for zero-shot O-RAN anomaly detection

DAST, a new zero-shot multi-agent framework from researchers including Francesco Spinelli and Xavier Costa-Perez, tackles anomaly detection in Open RAN (O-RAN) environments. O-RAN's disaggregated architecture and open interfaces expose it to Denial-of-Service and performance-degradation attacks, which account for most catalogued threats. Traditional time-series anomaly detection (TSAD) fails because labeled baselines are rare, attacks evolve quickly, and multivariate telemetry overwhelms monolithic models. DAST chains a three-stage VLM→LLM→VLM pipeline: first converting multivariate KPI streams into visual representations via VLMs, then scoring per-interface textual descriptions against O-RAN domain knowledge using an LLM, and finally verifying suspicious intervals on high-resolution heatmaps with a second VLM. The system outputs problematic interfaces, anomalous time windows, an O-RAN WG11-aligned impact rating, and a decision rationale.

The framework was evaluated on real network traces from an O-RAN testbed under representative performance degradation scenarios. DAST achieved a 0.910 F1-score and 0.843 accuracy, outperforming state-of-the-art TSAD baselines. Its zero-shot capability means it can detect novel attacks without retraining, a critical advantage in an environment where threats evolve faster than models can be updated. The multi-agent design also scales across interfaces, addressing the high-dimensional nature of O-RAN telemetry. Published on arXiv and submitted to IEEE, DAST represents a significant step toward practical AI-driven security for open network architectures.