DDoS Attack Detection and Mitigation in 5G Networks using P4 and SDN

5G is expected to support numerous Internet of Things (IoT) devices. However, the inherent vulnerabilities and limited resources of IoT devices make them susceptible to compromise and exploitation, potentially leading to Distributed Denial of Service (DDoS) attacks on 5G infrastructure from within. While conventional Intrusion Detection Systems (IDS) can assist, 5G’s unique protocols, such as the General Packet Radio Service (GPRS) Tunneling Protocol User Plane (GTP-U), pose challenges due to the inability to analyze packet headers. Therefore, we propose using Software-Defined Networking (SDN), Machine Learning (ML), and programmable switches that utilize the Programming Protocol-independent Packet Processors (P4) language to analyze GTP traffic on the fly for DDoS attack detection. Our framework enhances the efficiency of DDoS attack detection and mitigation, as demonstrated through evaluations on an actual 5G testbed using real datasets. Compared to an alternative solution that forwards GTP packets to the SDN controller, our method significantly reduces attack detection time while enhancing throughput on the SDN switch.