Malicious anomaly detection/localization in 5G systems through group behaviour profiling based on federated machinelLearning

点击翻译按钮获取中文摘要

Cloud computing and virtualization technologies including Network Function Virtualization and Software Defined Networking are now widely adopted in different industries including the highly sensitive and critical telecom industry. In particular, these technologies are increasingly deployed in the fifth generation (5G) of core networks. The adoption of these technologies provides great advantages such as flexibility and network programmability. However, it also increases the complexity of the system and expands the system attack surface, which requires special attention from a security perspective. While all aspects of cyber security (prevention, detection, mitigation, forensic, and auditing) are important, detection capabilities in particular play a significant role in securing the telecom systems, which in turn can be further specialized in attack detection, malware detection, and anomaly detection. Furthermore, the scope of anomaly detection can be further narrowed down to entities behavioral anomaly detection. For example, in this branch of detection, we would know if a specific component (e.g. microservice) is acting normal or abnormal based on its network and host interactions and activities. With the help of Machine Learning (ML), single entity normal behavior profiling and anomaly detection have been studied and improved extensively in recent years in the cybersecurity domain. However, fewer works consider profiling group behavior of multiple entities as their objective. This is due to the high dynamicity and complexity of the virtualized system, where this complexity is exacerbated with consideration of group behavior profiling, which requires a global view of the system. The main objective of this project is to investigate, design, and evaluate machine learning approaches to support the detection, identification, and localization of malicious anomalies in complex virtualized infrastructure deployed in 5G edge and core networks.