{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T16:10:31Z","timestamp":1780416631199,"version":"3.54.1"},"reference-count":50,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T00:00:00Z","timestamp":1775088000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001780","name":"Royal Melbourne Institute of Technology","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1016\/j.comnet.2026.112286","type":"journal-article","created":{"date-parts":[[2026,4,3]],"date-time":"2026-04-03T15:52:53Z","timestamp":1775231573000},"page":"112286","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Detection of RRC inactivity timer based signalling storm attack on 5G and B5G networks"],"prefix":"10.1016","volume":"282","author":[{"given":"Munazza","family":"Shabbir","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sithamparanathan","family":"Kandeepan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wayne","family":"Rowe","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0652-8626","authenticated-orcid":false,"given":"Akram","family":"Al-Hourani","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.comnet.2026.112286_bib0001","series-title":"2018 International Conference on Computing, Electronics & Communications Engineering (iCCECE)","first-page":"183","article-title":"Signaling storm problems in 3GPP mobile broadband networks, causes and possible solutions: a review","author":"Khan","year":"2018"},{"key":"10.1016\/j.comnet.2026.112286_bib0002","first-page":"1","article-title":"Modeling and analysis of RRC-based signalling storms in 3G networks","volume":"4","author":"Gorbil","year":"2015","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"key":"10.1016\/j.comnet.2026.112286_bib0003","series-title":"2024 IEEE Conference on Standards for Communications and Networking (CSCN)","first-page":"308","article-title":"A new sub-use case for signaling storm attack in open RAN and an ML-based detection approach","author":"Mayhoub","year":"2024"},{"issue":"6","key":"10.1016\/j.comnet.2026.112286_bib0004","doi-asserted-by":"crossref","first-page":"58","DOI":"10.1109\/MCOM.002.2300317","article-title":"Signaling storm in O-RAN: challenges and research opportunities","volume":"62","author":"Tabiban","year":"2024","journal-title":"IEEE Commun. Mag."},{"key":"10.1016\/j.comnet.2026.112286_bib0005","series-title":"IEEE INFOCOM 2023 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS)","first-page":"1-2","article-title":"Signaling storm detection in IIoT network based on the open RAN architecture","author":"Hoffmann","year":"2023"},{"key":"10.1016\/j.comnet.2026.112286_bib0006","article-title":"Toward securing the control plane of 5G mobile networks against DoS threats: attack scenarios and promising solutions","volume":"61","author":"Ettiane","year":"2021","journal-title":"J. Inf. Secur. Appl."},{"key":"10.1016\/j.comnet.2026.112286_bib0007","series-title":"IEEE INFOCOM 2024 - IEEE Conference on Computer Communications","first-page":"41","article-title":"Det-RAN: data-driven cross-layer real-time attack detection in 5G open RANs","author":"Scalingi","year":"2024"},{"issue":"1","key":"10.1016\/j.comnet.2026.112286_bib0008","first-page":"123","article-title":"Modeling and comprehensive review of signaling storms in 3GPP-based mobile broadband networks: causes, solutions, and countermeasures","volume":"142","author":"Khan","year":"2025","journal-title":"Comput. Model. Eng. Sci."},{"issue":"2","key":"10.1016\/j.comnet.2026.112286_bib0009","doi-asserted-by":"crossref","first-page":"860","DOI":"10.1109\/TII.2020.2974520","article-title":"Deep learning-based DDoS-attack detection for cyber-physical system over 5G network","volume":"17","author":"Hussain","year":"2021","journal-title":"IEEE Trans. Ind. Inf."},{"key":"10.1016\/j.comnet.2026.112286_bib0010","series-title":"2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS)","first-page":"1301","article-title":"Reducing cellular signaling traffic for heartbeat messages via energy-efficient D2D forwarding","author":"Jin","year":"2017"},{"key":"10.1016\/j.comnet.2026.112286_bib0011","series-title":"2021 IEEE 93rd Vehicular Technology Conference (VTC2021-Spring)","first-page":"1","article-title":"Efficient handling of small data transmission for RRC inactive UEs in 5G networks","author":"Khlass","year":"2021"},{"key":"10.1016\/j.comnet.2026.112286_bib0012","series-title":"Technical Report","article-title":"DRAFT Revised R2-2000580: 3GPP TS 38.331 v2 \u2013 EPS Voice Fallback (QC)","author":"3GPP TSG-RAN WG2","year":"2020"},{"key":"10.1016\/j.comnet.2026.112286_bib0013","unstructured":"Telecompedia, UE inactivity timer, n.d.Accessed: August 2025, https:\/\/telecompedia.net\/ue-inactivity-timer\/."},{"key":"10.1016\/j.comnet.2026.112286_bib0014","unstructured":"T. Forum, UE inactive timer parameter, 2021. https:\/\/www.telecomhall.net\/t\/ue-inactive-timer-parameter\/12755."},{"key":"10.1016\/j.comnet.2026.112286_bib0015","unstructured":"MyTelcoLearning, Inactivity timer and its impact on LTE KPI, 2020. Accessed: August 2025, https:\/\/mytelcolearning.blogspot.com\/2020\/01\/inactivity-timer-and-its-impact-on-lte.html."},{"issue":"3","key":"10.1016\/j.comnet.2026.112286_bib0016","doi-asserted-by":"crossref","first-page":"3231","DOI":"10.1109\/TNSM.2020.3035342","article-title":"REPEL: a strategic approach for defending 5G control plane from DDoS signalling attacks","volume":"18","author":"Silva","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"issue":"3","key":"10.1016\/j.comnet.2026.112286_bib0017","doi-asserted-by":"crossref","first-page":"514","DOI":"10.1017\/S0269964816000140","article-title":"Detecting network-unfriendly mobiles with the random neural network","volume":"30","author":"Abdelrahman","year":"2016","journal-title":"Probab. Eng. Inf. Sci."},{"key":"10.1016\/j.comnet.2026.112286_bib0018","series-title":"Technical Report","article-title":"WiMAX system evaluation methodology version 2.1","author":"Jain","year":"2008"},{"key":"10.1016\/j.comnet.2026.112286_bib0019","unstructured":"Gotify, Gotify: a simple server for sending and receiving messages, 2025. Accessed: August 2025, https:\/\/gotify.net\/."},{"key":"10.1016\/j.comnet.2026.112286_bib0020","unstructured":"W.D. Team, WireGuard: fast, modern, secure VPN tunnel, 2025. Accessed: August 2025, https:\/\/www.wireguard.com\/."},{"key":"10.1016\/j.comnet.2026.112286_bib0021","series-title":"Proceedings of the 21st International Conference on World Wide Web","first-page":"51-60","article-title":"Periodic transfers in mobile applications: network-wide origin, impact, and optimization","author":"Qian","year":"2012"},{"key":"10.1016\/j.comnet.2026.112286_bib0022","series-title":"2014 Sixth International Conference on Wireless Communications and Signal Processing (WCSP)","first-page":"1","article-title":"Facing the signaling storm: a method with stochastic concept","author":"Zhang","year":"2014"},{"key":"10.1016\/j.comnet.2026.112286_bib0023","series-title":"2017 IEEE AFRICON","first-page":"831","article-title":"Volume of signaling traffic reaching cellular networks from mobile phones","author":"Oteyo","year":"2017"},{"key":"10.1016\/j.comnet.2026.112286_bib0024","series-title":"Detection and Mitigation of Signaling Storms in Mobile Networks","first-page":"1","author":"Gelenbe","year":"2016"},{"key":"10.1016\/j.comnet.2026.112286_bib0025","series-title":"2023 19th International Conference on Network and Service Management (CNSM)","first-page":"1","article-title":"Mitigating signaling storms in 5G with blockchain-assisted 5GAKA","author":"Zhang","year":"2023"},{"issue":"1","key":"10.1016\/j.comnet.2026.112286_bib0026","doi-asserted-by":"crossref","first-page":"166","DOI":"10.1109\/MCOM.2014.6710079","article-title":"The impact of application signaling traffic on public land mobile networks","volume":"52","author":"Choi","year":"2014","journal-title":"IEEE Commun. Mag."},{"key":"10.1016\/j.comnet.2026.112286_bib0027","series-title":"PDCCS","first-page":"152","article-title":"On modeling of instant messaging traffic","author":"Kisner","year":"2008"},{"key":"10.1016\/j.comnet.2026.112286_bib0028","series-title":"27th International Conference on Distributed Computing Systems (ICDCS\u201907)","first-page":"51","article-title":"Understanding instant messaging traffic characteristics","author":"Xiao","year":"2007"},{"key":"10.1016\/j.comnet.2026.112286_bib0029","series-title":"Proceedings of the 2013 25th International Teletraffic Congress (ITC)","first-page":"1","article-title":"The role of the Weibull distribution in internet traffic modeling","author":"Arfeen","year":"2013"},{"issue":"1","key":"10.1016\/j.comnet.2026.112286_bib0030","article-title":"Behaviors of high-frequency subscribers in cellular data networks","volume":"2018","author":"Li","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"10.1016\/j.comnet.2026.112286_bib0031","series-title":"Proceedings of the 15th ACM International Conference on Modeling, Analysis and Simulation of Wireless and Mobile Systems","first-page":"325-332","article-title":"Characterization of 3G control-plane signaling overhead from a data-plane perspective","author":"Qian","year":"2012"},{"key":"10.1016\/j.comnet.2026.112286_bib0032","series-title":"Proceedings of the 15th International Conference on Human-Computer Interaction with Mobile Devices and Services","first-page":"352","article-title":"What\u2019s up with WhatsApp?","author":"Church","year":"2013"},{"issue":"3","key":"10.1016\/j.comnet.2026.112286_bib0033","doi-asserted-by":"crossref","first-page":"389","DOI":"10.1109\/LCOMM.2014.012014.132592","article-title":"Understanding the nature of social mobile instant messaging in cellular networks","volume":"18","author":"Zhou","year":"2014","journal-title":"IEEE Commun. Lett."},{"key":"10.1016\/j.comnet.2026.112286_bib0034","series-title":"Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks","article-title":"Paging storm attacks against 4G\/LTE networks from regional android botnets: rationale, practicality, and implications","author":"Fang","year":"2020"},{"key":"10.1016\/j.comnet.2026.112286_bib0035","unstructured":"F. Shoaib, Securing software-defined networks against timing side-channel attacks (2025). 10.71747\/uow-r3gk326m.28386014.v1."},{"key":"10.1016\/j.comnet.2026.112286_bib0036","series-title":"Technical Specification (TS)","article-title":"5G; NR; Radio Resource Control (RRC); Protocol Specification (3GPP TS 38.331 Version 16.20.0 Release 16)","author":"ETSI","year":"2025"},{"key":"10.1016\/j.comnet.2026.112286_bib0037","unstructured":"V. Kamarthi, RRC_INACTIVE state in 5G NR, 2025, (NXG Connect Blog). Accessed: 2025-01-16, https:\/\/www.nxgconnect.com\/post\/rrc_inactive-state-in-5g-nr."},{"key":"10.1016\/j.comnet.2026.112286_bib0038","unstructured":"J. Lam, R. Abbas, Machine learning based anomaly detection for 5G networks, CoRR abs\/2003.03474(2020). arXiv: 2003.03474."},{"key":"10.1016\/j.comnet.2026.112286_bib0039","series-title":"Anais do XX ENMC - Encontro Nacional de Modelagem Computacional e VIII ECTM - Encontro de Ci\u00eancias e Tecnologia de Materiais","article-title":"A statistical distance derived from the Kolmogorov-Smirnov test: specification, reference measures (benchmarks) and example uses","author":"Fabbri","year":"2017"},{"key":"10.1016\/j.comnet.2026.112286_bib0040","doi-asserted-by":"crossref","first-page":"4765","DOI":"10.1007\/s10462-022-10275-5","article-title":"Recent advances in decision trees: an updated survey","volume":"56","author":"Costa","year":"2023","journal-title":"Artif. Intell. Rev."},{"issue":"2","key":"10.1016\/j.comnet.2026.112286_bib0041","doi-asserted-by":"crossref","first-page":"415","DOI":"10.1109\/72.991427","article-title":"A comparison of methods for multiclass support vector machines","volume":"13","author":"Hsu","year":"2002","journal-title":"IEEE Trans. Neural Netw."},{"key":"10.1016\/j.comnet.2026.112286_bib0042","unstructured":"G. Louppe, Understanding Random Forests: From Theory to Practice, 2015. arXiv: 1407.7502."},{"key":"10.1016\/j.comnet.2026.112286_bib0043","unstructured":"I. The MathWorks, Communications toolbox version: 8.0 (r2024a), 2024, https:\/\/www.mathworks.com\/products\/communications.html."},{"issue":"2","key":"10.1016\/j.comnet.2026.112286_bib0044","doi-asserted-by":"crossref","DOI":"10.3390\/cryptography8020022","article-title":"Defence against side-channel attacks for encrypted network communication using multiple paths","volume":"8","author":"Haywood","year":"2024","journal-title":"Cryptography"},{"key":"10.1016\/j.comnet.2026.112286_bib0045","doi-asserted-by":"crossref","unstructured":"B. Trammell, M. K\u00fchlewind, The wire image of a network protocol, 2019, (RFC 8546). 10.17487\/RFC8546.","DOI":"10.17487\/RFC8546"},{"key":"10.1016\/j.comnet.2026.112286_bib0046","article-title":"Detecting flooding DDoS attacks in software defined networks using supervised learning techniques","volume":"35","author":"Wang","year":"2022","journal-title":"Eng. Sci. Technol. Int. J."},{"issue":"2","key":"10.1016\/j.comnet.2026.112286_bib0047","article-title":"Mitigating denial of service signaling threats in 5G mobile networks","volume":"12","author":"Ettiane","year":"2021","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"10.1016\/j.comnet.2026.112286_bib0048","series-title":"2024 IEEE VTS Asia Pacific Wireless Communications Symposium (APWCS)","first-page":"1","article-title":"Defending 5G networks against DDoS attacks using quarantine slice manager architecture","author":"Amogh","year":"2024"},{"key":"10.1016\/j.comnet.2026.112286_bib0049","series-title":"2019 IEEE Conference on Communications and Network Security (CNS)","first-page":"82","article-title":"Towards secure slicing: using slice isolation to mitigate DDoS attacks on 5G core network slices","author":"Sattar","year":"2019"},{"key":"10.1016\/j.comnet.2026.112286_bib0050","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103269","article-title":"Analyzing effective mitigation of DDoS attack with software defined networking","volume":"130","author":"Dayal","year":"2023","journal-title":"Comput. Secur."}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626002987?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626002987?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T15:52:18Z","timestamp":1780415538000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128626002987"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":50,"alternative-id":["S1389128626002987"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112286","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Detection of RRC inactivity timer based signalling storm attack on 5G and B5G networks","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112286","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Author(s). Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"112286"}}