User Terminals as Attackers: An Open Dataset Analysis of DDoS Attacks in 5G Networks

The 5th Generation (5G) of cellular networks, developed by the 3rd Generation Partnership Project (3GPP), aims to meet the growing demands for data and communication services. A key component of the 5G architecture is the Network Data Analytics Function (NWDAF), which enhances network performance and detects anomalies by analyzing real-time data. This paper focuses on detecting abnormal user behavior, specifically Distributed Denial of Service (DDoS) attacks, using a comprehensive dataset captured in a 5G testbed. We compare the Z-score method, a traditional statistical method, with machine learning models, including Decision Trees, Naive Bayes, kNN, and XGBoost. Our results demonstrate the improved performance of machine learning models in detecting anomalies in this context. Furthermore, we study the impact of various network features through Principal Component Analysis (PCA), while also employing the inherent explainability capability of Decision Trees to highlight the importance of features in distinguishing between benign and malicious traffic. This study provides valuable insights into DDoS detection in 5G networks, and the dataset is made publicly available to facilitate further research.

I. Introduction

The Fifth Generation (5G) of mobile networks represents the latest advancement in cellular technology, designed to address the increasing demands of the digital era through enhanced speed, latency, capacity, and reliability. This evolution introduced a transition to a software-driven architecture, emphasizing virtualization and cloud technologies, and adopted a Service-Based Architecture (SBA) for scalable and modular Network Functions (NFs). The Network Data Analytics Function (NWDAF), introduced in the 3rd Generation Partnership Project (3GPP) Release 15, marked a significant move towards data-driven and proactive network management. NWDAF’s primary role is to gather and analyze data from across the 5G network, including performance metrics, user behavior, and network conditions, to optimize network performance, resource management, and user experience. Integrated within the SBA of 5G, the NWDAF communicates with other network functions through standardized interfaces, enabling comprehensive data collection and analytics services. It may employ sophisticated data analytics and machine learning algorithms to anticipate network demands, identify anomalies, and suggest network configuration adjustments. The NWDAF can be used in a broad spectrum of applications [1], enhancing network security, optimizing quality of service, facilitating network slicing for varied service demands, and supporting edge computing for applications requiring low latency.