User Terminals as Attackers: An Open Dataset Analysis of DDoS Attacks in 5G Networks
Maria I. Christopoulou, Apostolis Garos, Athina Vekraki, Dimitris Santorinaios, Ioannis Koufos, Sofia Karamitsiani, George K. Xilouris, Michail‐Alexandros Kourtis, Georgios Gardikis, Panagiotis T. Trakadas · 2024
The 5th Generation (5G) of cellular networks, developed by the 3rd Generation Partnership Project (3GPP), aims to meet the growing demands for data and communication services. A key component of the 5G architecture is the Network Data Analytics Function (NWDAF), which enhances network performance and detects anomalies by analyzing real-time data. This paper focuses on detecting abnormal user behavior, specifically Distributed Denial of Service (DDoS) attacks, using a comprehensive dataset captured in a 5G testbed. We compare the Z-score method, a traditional statistical method, with machine learning models, including Decision Trees, Naive Bayes, kNN, and XGBoost. Our results demonstrate the improved performance of machine learning models in detecting anomalies in this context. Furthermore, we study the impact of various network features through Principal Component Analysis (PCA), while also employing the inherent explainability capability of Decision Trees to highlight the importance of features in distinguishing between benign and malicious traffic. This study provides valuable insights into DDoS detection in 5G networks, and the dataset is made publicly available to facilitate further research.