A Zero-Touch O-RAN Framework for Federated Few-Shot IDS with LLM-Oracle Verification

This paper presents FFS-ORAN-IDS, a federated few-shot intrusion-detection framework that secures streaming traffic in Open Radio Access Networks (O-RAN) while respecting their stringent latency and resource constraints. The framework addresses the twin challenges of scarce attack labels and heterogeneous data, where naïve pseudo-label injection without sufficient confidence propagates errors, large-scale labeling of streaming traffic is impractical, and inherent uncertainty often requires costly human intervention. FFS-ORAN-IDS combines three coordinated x-functional blocks: a confidence-adaptive curriculum that releases pseudo-labels only when local TabTransformers are reliable, a diversity filter that retains the most informative uncertain packets, and a token-budgeted large-language-model (LLM) oracle that verifies the remaining hard samples. A mixed-integer optimization jointly governs curriculum pacing, sampling size, and Oracle LLM calls so that each federated round minimizes detection loss, propagation error, and LLM token cost under per-round resource caps. We train FFS-ORAN-IDS in two stages: an initial few-shot phase that fits the TabTransformer on the scarce ground-truth packets, followed by iterative rounds that refine the model with oracle-verified pseudo-labels. Experimental evaluation on the CIC-IDS 2018 benchmark shows that the proposed framework improves detection accuracy by 6%, reduces label-error propagation by 20%, and lowers energy consumption by 40% in the most label-constrained scenarios.