LSTM based Anomaly Detection of PFCP Signaling Attacks in 5G Networks

Fifth-generation telecommunication networks (5G) will offer a range of new services and support an array of new use cases beyond traditional mobile networking. This is achieved in part by a renovated core network architecture that adopts a suite of new technologies. As new service capabilities emerge so do the security threats that pose a significant risk to consumer electronic devices that use 5G services. Among these are signaling attacks which can potentially disrupt services and expose private user data. In this article a Machine Learning (ML) model is proposed as a potential solution for detecting malicious signaling flows by way of anomaly detection in signaling traffic. A Long Short Term Memory (LSTM) network is utilized to predict traffic patterns and detect anomalous signaling associated with the Packet Forward Control Protocol (PFCP) attack. The model is trained using a dataset of benign service interactions and tested on a dataset containing simulated PFCP signaling attacks. Based on this approach the LSTM model can identify anomalous packets with 95% accuracy for the given PFCP attack scenario.