Detection of RRC inactivity timer based signalling storm attack on 5G and B5G networks

Instant messaging applications (IM apps) are among the most frequent sources of signalling storms in mobile networks. Poorly designed IM apps can be exploited by adversaries to initiate stealthy signalling storm attacks (SSAs). Recent advancements in the 5G Radio Resource Control (RRC) protocol have introduced a novel attack vector, where malicious actors manipulate the 5G inactivity timer to generate excessive signalling messages. Due to the inherent complexity of the working mechanism of the IM app and the diversity of user behavior, distinguishing between legitimate and malicious IM signalling traffic is a challenge. In this study, a comprehensive source traffic model (STM) is presented that captures the operational dynamics of modern IM applications alongside a wide spectrum of user interaction patterns. This model enables a deeper understanding of normal IM traffic and its corresponding signalling load. Building upon this foundation, we introduce a threat model that demonstrates how attackers can emulate normal user behavior and exploit IM app functionalities to launch inactivity timer-based SSAs in 5G networks. To detect such attacks, two novel traffic analysis features: Burst Correlation Index (BCI) and Kolmogorov–Smirnov Distance Contrast (KSDC) are proposed. These metrics effectively highlight subtle differences between benign and malicious traffic patterns, enhancing classification accuracy significantly.