Lightweight intrusion detection baselines for Open RAN xApps

The transition to Open Radio Access Networks (Open RAN) introduces new attack surfaces at the RAN Intelligent Controller (RIC) and O-Cloud. Securing these interfaces requires Intrusion Detection Systems (IDS) that can operate under the strict latency constraints of the Near-Real-Time (Near-RT) RIC. However, existing research often prioritizes complex Deep Learning (DL) architectures without justifying their computational cost against the microsecond-level requirements of xApp deployment. This paper establishes a rigorous, reproducible baseline for the NetsLab-5GORAN-IDD dataset, performing a multilayer benchmark on both network flows and radio telemetry. We evaluate twelve algorithms, comparing lightweight machine learning models against complex DL architectures. Our empirical results challenge the assumption that model complexity equates to better security in O-RAN. We demonstrate that lightweight ensemble methods (e.g., Extra Trees, XGBoost) achieve superior detection performance (F1-score > 99%) compared to LSTM and CNN models, while operating at a fraction of the inference latency. Specifically, we identify single Decision Trees as viable candidates for ultra-low latency O-DU filtering, operating orders of magnitude faster than deep learning alternatives. In contrast, DL models like LSTM incurred latencies exceeding 2800 μs (>1000x slower than lightweight models) without yielding performance gains. These findings provide critical design guidance for developing practical, real-time security xApps.