Method and apparatus for DDoS attack detection and mitigation in IoT network slices of 5G networks
An apparatus and lightweight method detects and prevents DDoS attacks in a 5G-IoT slice in real-time without putting the stress of security on the constrained IoT devices. The apparatus includes eight IoT devices, a gNB, and 5G core network. The core network includes of AMF, SMF, UPF, PCF, UDR, and Network Data Analytics Function (NWDAF). 5 IoT devices connected to an IoT slice via a gNB RAN and core network are loaded with DDoS code. The gNB gives the RAN part of the slice to the IoT devices while as core network functions provide the core network part of the slice. A real-time and lightweight method consisting of Intrusion Detection System (IDS) and honeypots is designed for DDoS attack detection in 5G IoT/mMTC slices. The system identifies the attack efficiently and is able to mitigate it with less computation and storage costs.
1 . A method for real-time and lightweight detection and mitigation of Distributed Denial of Service (DDoS) attacks in Internet of Things (IoT) network slices of a 5G network, the method comprising:
implementing a 5G Service-Based Architecture (5G-SBA);
identifying weakest points in an IoT slice through continuous monitoring of network behavior;
turning the identified weakest points into one or more honeypots;
monitoring, in real time at a gNodeB (gNB) and at one or more core network functions, a plurality of features including at least: data packets, outlier movement to critical slices, control/signaling messages, connection setup behavior, deviation from 5G Authentication and Key Agreement (5G-AKA), congestion, re-authentication frequency, abnormal slice switching, Access Mobility Function (AMF)/Session Management Function (SMF) overload, unnecessary slice switch requests, and wrong-time slice switch requests;
applying a machine-learning or deep-learning based anomaly analyzer to the plurality of monitored features and declaring an attack condition upon detection of concurrent anomalies across the plurality of monitored features; and
enforcing, via the AMF, the SMF, and a Policy Control Function (PCF), per-user equipment (UE) security policies including restricting slice switching, redirecting affected UE to a cleansing protocol data unit (PDU) session, and adjusting UE aggregate maximum bit rate (AMBR) via a user plane function (UPF).
2 . The method of claim 1 , wherein the one or more honeypots are installed on a device layer or on a communication links between IoT devices and the gNB.
3 . The method of claim 1 , wherein the one or more honeypots are deployed to deceive the attackers.
4 . The method of claim 1 , wherein the one or more honeypots are constantly monitored for new threats and analyzed to build required threat intelligence to proactively mitigate production systems from similar attack surfaces.