Effective Feature Selection Methods to Detect IoT DDoS Attack in 5G Core Network

Abstract

The 5G networks aim to realize a massive Internet of Things (IoT) environment with low latency. IoT devices with weak security can cause Tbps-level Distributed Denial of Service (DDoS) attacks on 5G mobile networks. Therefore, interest in automatic network intrusion detection using machine learning (ML) technology in 5G networks is increasing. ML-based DDoS attack detection in a 5G environment should provide ultra-low latency. To this end, utilizing a feature-selection process that reduces computational complexity and improves performance by identifying features important for learning in large datasets is possible. Existing ML-based DDoS detection technology mostly focuses on DDoS detection learning models on the wired Internet. In addition, studies on feature engineering related to 5G traffic are relatively insufficient. Therefore, this study performed feature selection experiments to reduce the time complexity of detecting and analyzing large-capacity DDoS attacks in real time based on ML in a 5G core network environment. The results of the experiment showed that the performance was maintained and improved when the feature selection process was used. In particular, as the size of the dataset increased, the difference in time complexity increased rapidly. The experiments show that the real-time detection of large-scale DDoS attacks in 5G core networks is possible using the feature selection process. This demonstrates the importance of the feature selection process for removing noisy features before training and detection. As this study conducted a feature study to detect network traffic passing through the 5G core with low latency using ML, it is expected to contribute to improving the performance of the 5G network DDoS attack automation detection technology using AI technology.

A Comparison Experiment of Binary Classification for Detecting the GTP Encapsulated IoT DDoS Traffics in 5G Network

“…Previous studies used ML to detect DDoS attacks effectively on 5G mobile networks [19][20][21][22]. Especially final previous work is similar to our study in that it constructed a virtual 5G environment with a Kitsune dataset, and collected a 5G dataset on its own, which was used to perform detection [22]. They used one gNB in the 5G testbed, however, we have experimented in a more realistic 5G environment by building multiple gNBs.…”

“…Kim et al [22] studied a feature selection-applied ML method to detect IoT DDoS attacks with low time complexity in a 5G mobile network environment. These work constructed a virtual 5G experimental environment and used the Kitsune dataset to build a 5G GTP-U dataset [22].…”

“…Kim et al [22] studied a feature selection-applied ML method to detect IoT DDoS attacks with low time complexity in a 5G mobile network environment. These work constructed a virtual 5G experimental environment and used the Kitsune dataset to build a 5G GTP-U dataset [22]. In the experimental results, the DT, RF, KNN, and Stacking algorithms showed 88.69%, 92.03%, 82.46%, and 97.18% accuracy, respectively.…”

“…They used one gNB in the 5G testbed, however, we have experimented in a more realistic 5G environment by building multiple gNBs. In addition, these studies did not consider hyperparameter tuning for performance improvement [19][20][21][22]. As far as we know, hyperparameter optimization research for DDoS detection is focused on wire network environments.…”

“…Research to analyze attack detection performance by optimizing ML models in a wired network environment is being actively conducted [12][13][14][15][16][17][18]. In addition, other previous studies conducted attack detection studies using ML models in 5G networks [19][20][21][22]. However, studies that consider hyperparameter tuning to optimize ML models in 5G networks are currently lacking.…”