Toward Reliable Intrusion Monitoring for O-RAN Based Networks with Conformal False Alarm Control

Autoencoder-based intrusion detectors provide a practical option for Open Radio Access Network (O-RAN) environments because they can be trained from benign traffic and deployed as monitoring components, such as eXtended Applications. However, alarm thresholds of the intrusion detectors are typically determined by heuristic rules, which makes them difficult to integrate into confidence-gated closed-loop management. In this type of management, uncontrolled false alarms may trigger disruptive mitigation actions. In this paper, we propose a covariance-aware conformal detector for unsupervised intrusion detection with a false alarm rate (FAR) constraint. The method uses a Mahalanobis distance in the reconstruction error space of the autoencoder as the nonconformity score and calibrates the threshold by split conformal prediction. Under exchangeability between the benign calibration samples and future benign test samples, the proposed detector controls the FAR within a user-specified budget. For 5th Generation traffic, the proposed score increases the detection rate compared to the conformal baseline at the same target FAR. The quadratic score also decomposes exactly into feature-wise diagnostic terms, providing low-cost per-alarm triage without post-hoc explanation models. The online detector operates with microsecond-scale latency, which enables deployment to Near-Real-Time RAN Intelligent Controller.