5G DDoS Simulation, Machine Learning Models & Multi-Access Edge Computing Applications for Attack Detection and Prevention

Sammanfattning

The increasing use of 5G networks and their application in critical services makes them vulnerable to Distributed Denial of Service (DDoS) attacks. This thesis investigates the detection and mitigation of DDoS attacks in 5G networks using machine learning (ML) methods. In particular, it analyses two exciting convolutional neural network (CNN)-based models: the LUCID model and the Mohak model, and introduces a simpler logistic regression model based solely on packet length. Three datasets were used to evaluate their performance: the publicly available CICDDoS2019 (only UDP flood traffic) and two newly generated simulated datasets – "BoNeSi+Simu5G" and "Mixed Simu5G" datasets. According to the evaluations, the LUCID and Mohak models struggled to generalise beyond their initial training dataset (CICDDoS2019), particularly when dealing with data generated by the BoNeSi tool. However, Mohak's CNN did well using data that was entirely Simu5G-generated ("Mixed Simu5G" dataset). The basic logistic regression model detected UDP flood attacks based on packet length. However, it was not sufficiently robust against complex attacks. The models were deployed in a Multi-access Edge Computing (MEC) application in the 5G simulator, Simu5G. According to the results, the models performed poorly when deployed in the simulation, partly due to the models and partly due to the implementation. Although there is room for improvement, particularly in the areas of data collection and analysis, the study showed that ML-based detection and prevention using a MEC application is feasible in 5G simulation environments.