5GC PFCP Intrusion Detection Dataset

Citation Author(s):
George
Amponis
K3Y Ltd
Panagiotis
Radoglou-Grammatikis
K3Y Ltd
George
Nakas
K3Y Ltd
Maria
Zevgara
K3Y Ltd
Sofia
Giannakidou
K3Y Ltd
Savvas
Ouzounidis
K3Y Ltd
George
Kakamoukas
K3Y Ltd
Antonios
Sarigiannidis
K3Y Ltd
Submitted by:
Panagiotis Rado...
Last updated:
Tue, 05/09/2023 - 09:51
DOI:
10.21227/e0gj-ev03
Data Format:
Research Article Link:
Links:
License:
1
1 rating - Please login to submit your rating.

Abstract 

The advancements in the field of telecommunications have resulted in an increasing demand for robust, high-speed, and secure connections between User Equipment (UE) instances and the Data Network (DN). The implementation of the newly defined 3rd Generation Partnership Project 3GPP (3GPP) network architecture in the 5G Core (5GC) represents a significant leap towards fulfilling these demands. This architecture promises faster connectivity, low latency, higher data transfer rates, and improved network reliability. 5GC has been designed to support a wide range of critical Next Generation Internet of Things (NG-IoT) and industrial use cases that require reliable end-to-end communication services. However, this evolution raises severe security issues. In the context of the SANCUS project, a set of cyberattacks were investigated and emulated by K3Y against the Packet Forwarding Control Protocol (PFCP) between the Session Management Function (SMF) and the User Plane Function (UPF). Based on these attacks, an intrusion detection dataset was generated: 5GC PFCP Intrusion Detection Dataset that can support the development of Artificial Intelligence (AI)-powered Intrusion Detection Systems (IDS) that use Machine Learning (ML) and Deep Learning (DL) techniques. The goal of this report is to describe this dataset.

Funding Agency: 
Horizon 2020 Research and Innovation Programme
Grant Number: 
952672

Comments

.

Submitted by Adil Hannoune on Tue, 06/20/2023 - 11:43

Dear Sir/Madam,

I would like to inquire about the corresponding IP addresses associated with specific network functions, particularly SMF, UPF, and MSMF.

I find it perplexing that, upon examining the PCAP files "MSMF.pcap" and "UPF.pcap" from the "PFCP Session Deletion DoS Attack/20221310_PFCP_PFCP_Sess_Deletion_DoS_Test_07_4h" directory, I observed that the IP address sending the "pfcp_deletion_request" appears to be "172.21.0.107." However, the files "PFCP Session Deletion DoS Attack/20221310_PFCP_PFCP_Sess_Deletion_DoS_Test_07_4h/CiCFlowMeter Flows/240-sec-CSV/MSMF.csv" indicate that "172.21.0.120 -> 172.21.0.110" or "172.21.0.110 -> 172.21.0.120" are labeled as malicious.

I am keen to understand the rationale behind this discrepancy. Is the IP address of MSMF indeed "172.21.0.107"? If so, what is the reason behind labeling "172.21.0.120" as malicious in the CSV file generated by CiCFlowMeter?

Thank you for your assistance.

Submitted by Shi Huang Tseng on Tue, 11/07/2023 - 08:45