AI-driven predictive intelligence for detection and early warning of unseen cyberthreats in 5G/6G networks

The exponential growth in telecommunications and artificial intelligence is transforming the landscape of cybersecurity, creating a dynamic environment where new attack vectors, including increasingly sophisticated Distributed Denial of Service (DDoS) attacks, continuously emerge. In this rapidly evolving field, staying ahead of threats is a formidable challenge. Companies worldwide report significant financial losses due to security breaches, with estimates ranging between £600,000 and £1.15 million per incident. As B5G and the forthcoming 6G networks become integral to global communications, there is an urgent need for advanced solutions that can protect these critical infrastructures. The integration of Software Defined Networks (SDN) and AI-driven automation into these networks is not just beneficial but essential for enabling robust cybersecurity defenses. These technologies lay the groundwork for creating emulated environments and testbeds, where potential vulnerabilities can be explored, and automated frameworks for real-time attack detection and mitigation can be developed. This PhD thesis seeks to expand the research domain in these crucial directions, contributing to the cybersecurity community with innovative frameworks and datasets that provide valuable insights and actionable solutions. The first major contribution is the design and implementation of a comprehensive framework for emulating B5G network topologies. This framework serves as a versatile testbed for executing cyberattack scenarios and incorporating detection, analysis, and mitigation features directly into the control and management planes of emulated networks. The framework is flexible, operating in both single and distributed modes, allowing for performance comparisons. In single mode, the framework can set up, configure, and execute a full B5G network topology in just 11.15 minutes, while the distributed mode, which offers enhanced performance, completes the process in 19.85 minutes. Importantly, the distributed system maintained a stable bandwidth of 2 Gbps whilesuccessfully mitigating attacks on 64 emulated infected UEs, demonstrating its capability to handle complex and high-stakes scenarios.Building on this foundation, the thesis presents a topology-aware cognitive self-protection loop designed to autonomously detect, analyze, and mitigate DDoS attacks in 5G-IoT environments. This self-protection loop comprises three core components: Network Flow Monitoring (NFM), responsible for the fine-grained detection and analysis of malicious network flows; Network Self-Healing (NSH), which acts as the brain of the loop by conducting predictive analysis to determine the optimal mitigation plan; and Network Self-Protection (NSP), which executes the mitigation actions across various datapath technologies, includingOpen vSwitch (OVS) and Traffic Control (TC). In rigorous testing within a 5G-IoT emulated scenario, the cognitive self-protection loop demonstrated its efficacy by mitigating cyberattacks in under 2 minutes, even as the number of UEs varied between 8 and 64 and the numberof Edge servers increased from 2 to 4.The third significant contribution of this thesis is the development of an evolved and enhanced distributed cognitive self-protection loop. By distributing the control and management planes among the network’s stakeholders, this system achieves a collaborative, yet zero-information exchange, self-protection loop. This approach not only preserves theprivacy and autonomy of each stakeholder but also significantly improves the system’s overall performance. In tests conducted within B5G emulated scenarios, the distributed cognitive loop successfully managed the stable emulation of 128 UEs, achieving a 100% mitigation success rate. This solution was validated through the integration and coordination of up toseven software components within the cognitive loop, further demonstrating its scalability and effectiveness in complex network environments. Finally, leveraging the insights gained from these developments, the thesis introducesa novel dataset specifically designed for AI/ML-based cybersecurity research. The dataset includes six classes—three representing different types of DDoS attacks and three representing legitimate network traffic patterns—captured across both topology and network flow domains. This dual-domain approach provides an extended perspective on network behavior,enabling more accurate and nuanced classification of network patterns. The Histogram-based Gradient Boosting Classifier (HGBC) model applied to this dataset achieved remarkable results, with accuracy rates of 99.92% in the best-case scenario and 98.62% in the worst case,and an inference time of just 5.5 milliseconds. These results underscore the potential of AI and ML in enhancing the security of next-generation networks, even as network topologies evolve. In conclusion, this research advances the state of the art in network security, providing a robust framework and a comprehensive dataset that together offer a solid foundation for the continued development of AI-driven cybersecurity solutions for B5G and 6G networks.The contributions of this thesis not only address current challenges but also pave the way for future innovations in safeguarding the communications infrastructure of tomorrow.