Early Detection of DoS Attacks in 5G Core Networks

5G introduces various innovations and opportunities across network infrastructures, with network slicing and Network Function Virtualization (NFV) being significant contributions. These technologies support diverse applications, infrastructure, and connectivity. NFV, in particular, enables different network functions to serve various user requests via the control plane and handle traffic via the data plane. However, network functions involved in handling control plane requests, such as the Access and Mobility Management Function (AMF), are targeted by attackers, particularly through Denial of Service (DoS) attacks. This work addresses DoS attacks during the slice synchronization process. To assess the impact of these attacks, we analyzed their effects and conducted a vulnerability assessment using attack graphs, demonstrating the impact on various network functions of 5G Core (5GC) networks. Our approach leverages dynamic thresholding and ensemble learning techniques for effective mitigation. Initially, we compute the Power Spectral Density (PSD)-based entropy and compare it against dynamic threshold values. To enhance detection accuracy and address instances not covered by the PSD-entropy method, we employ an ensemble learning-based classification algorithm. Our proposed method achieves better accuracy across various types of traffic and differing numbers of attackers.