Excessive signaling by devices against a radio access network (RAN) can be detected and mitigated. A security management component (SMC) can determine whether a total number of control signals received by a base station from devices satisfies a threshold total number of control signals indicative of excessive signaling. If so, SMC can identify a device associated with the base station based on analyzing communication conditions associated with the device. SMC can determine whether to classify the device as an excessive signaling device based on whether the number of control signals received from the device by the base station satisfies a threshold number of control signals indicative of excessive signaling. If so, SMC can determine the device is an excessive signaling device. In response, SMC can perform or facilitate performing a mitigation action to mitigate excessive signaling or can generate statistics relating to the excessive signaling.