LSTM-Based Anomaly Detection of PFCP Signaling Attacks in 5G Networks

Robert Pell, Mohammad Shojafar, Sotiris Moschoyiannis

Abstract: Fifth-generation telecommunication networks (5G) will offer a range of new services and support an array of new use cases beyond traditional mobile networking. This is achieved in part by a renovated core network architecture that adopts a suite of new technologies. As new service capabilities emerge so do the security threats that pose a significant risk to consumer electronic devices that use 5G services. Among these are signaling attacks, which can potentially disrupt services and expose private user data. In this article a machine learning model is proposed as a potential solution for detecting malicious signaling flows by way of anomaly detection in signaling traffic. A long short term memory (LSTM) network is utilized to predict traffic patterns and detect anomalous signaling associated with the packet forward control protocol (PFCP) attack. The model is trained using a dataset of benign service interactions and tested on a dataset containing simulated PFCP signaling attacks. Based on this approach, the LSTM model can identify anomalous packets with 95% accuracy for the given PFCP attack scenario.

External IDs:dblp:journals/cem/PellSM25