Attacks Against Mobility Prediction in 5G Networks

The 5^th generation of mobile networks introduces a new Network Function (NF) that was not present in previous generations, namely the Network Data Analytics Function (NWDAF). Its primary objective is to provide advanced analytics services to various entities within the network and also towards external application services in the 5G ecosystem. One of the key use cases of NWDAF is mobility trajectory prediction, which aims to accurately support efficient mobility management of User Equipment (UE) in the network by allocating "just in time" necessary network resources. In this paper, we show that there are potential mobility attacks that can compromise the accuracy of these predictions. In a semi-realistic scenario with 10,000 subscribers, we demonstrate that an adversary equipped with the ability to hijack cellular mobile devices and clone them can significantly reduce the prediction accuracy from 75% to 40% using just 100 adversarial UEs. While a defense mechanism largely depends on the attack and the mobility types in a particular area, we prove that a basic KMeans clustering is effective in distinguishing legitimate and adversarial UEs.

I. Introduction

According to the recent Ericsson mobility report, 5G mobile networks will reach 5 billion subscriptions by 2028. Compared to the previous generations, 5G will become the main subscription type in the coming years due to its support for higher speeds, higher bandwidth, lower latencies, improved security/privacy, and network capabilities exposure towards industry verticals and enterprises. For this reason, 5G is also considered a platform that enables innovation to investigate novel data-driven use cases, applications, and automation. NWDAF is a new network function that the 3G Partnership Project (3GPP) formalized in response to the maturity of Artificial Intelligence (AI) in recent years. NWDAF intends to benefit from the explosion of data generated by 5G. Its architecture and API are documented in 3GPP Technical Specification (TS) 23.288 [1] and TS 29.520 [2], respectively. NWDAF’s main objective is to provide internal analytics service to other NFs to automate processes, i.e., troubleshooting, resource allocation, and anomaly detection.