Zero-touch security management for mMTC network slices: DDoS attack detection and mitigation

Massive Machine Type Communications (mMTC) network slices in 5G aim to connect a massive number of MTC devices, opening the door for a widened attack surface. Network slices are well isolated, resulting in a low impact on other running slices when attackers control IoT devices belonging to a mMTC network slice (i.e., in-slice attack). However, the impact of the in-slice attacks on the shared infrastructure components with other slices, such as the 5G Core Network (CN), can be harmful, considering the massive number that can be part of mMTC slice. In this paper, we propose a zero-touch security management solution that uses Machine Learning (ML) to detect and mitigate in-slice attacks on 5G CN components, focusing on Distributed Denial of Service (DDoS) attacks. To this aim, we propose: (1) a novel closed-control loop that assists the 5G CN in detecting and mitigating attacks; (2) a ML algorithm that predicts the upper bound of expected MTC devices Attach Requests during a time interval (or an event); (3) a detection algorithm that analyzes an event and uses the ML output to compute a probability that a specific device has participated to an attack; (4) a mitigation algorithm that disconnects and blocks MTC devices suspected to be part of an attack; (5) a Proof of concept implementation on top of a 5G facility.