Malicious anomaly detection/localization in 5G systems through group behaviour profiling based on federated machinelLearning

包括网络功能虚拟化和软件定义网络在内的云计算和虚拟化技术现在被广泛应用于不同的行业，包括高度敏感和关键的电信行业。特别是，这些技术越来越多地部署在第五代(5G)核心网络中。采用这些技术提供了极大的优势，如灵活性和网络可编程性。然而，它也增加了系统的复杂性，扩大了系统攻击面，从安全角度需要特别关注。虽然网络安全的所有方面(预防、检测、缓解、取证和审计)都很重要，但检测功能在保护电信系统安全方面发挥着特别重要的作用，而电信系统又可以进一步专门用于攻击检测、恶意软件检测和异常检测。此外，异常检测的范围可以进一步缩小到实体行为异常检测。例如，在此检测分支中，我们将根据特定组件(例如微服务)的网络和主机交互和活动知道其运行正常还是异常。近年来，在机器学习的帮助下，单个实体的正常行为描述和异常检测在网络安全领域得到了广泛的研究和改进。然而，很少有研究将剖析多个实体的群体行为作为他们的目标。这是由于虚拟化系统的高度动态化和复杂性，其中这种复杂性因考虑群体行为分析而加剧，这需要系统的全局视图。本项目的主要目标是调查、设计和评估机器学习方法，以支持检测、识别和定位5G边缘和核心网络中部署的复杂虚拟基础设施中的恶意异常。

Cloud computing and virtualization technologies including Network Function Virtualization and Software Defined Networking are now widely adopted in different industries including the highly sensitive and critical telecom industry. In particular, these technologies are increasingly deployed in the fifth generation (5G) of core networks. The adoption of these technologies provides great advantages such as flexibility and network programmability. However, it also increases the complexity of the system and expands the system attack surface, which requires special attention from a security perspective. While all aspects of cyber security (prevention, detection, mitigation, forensic, and auditing) are important, detection capabilities in particular play a significant role in securing the telecom systems, which in turn can be further specialized in attack detection, malware detection, and anomaly detection. Furthermore, the scope of anomaly detection can be further narrowed down to entities behavioral anomaly detection. For example, in this branch of detection, we would know if a specific component (e.g. microservice) is acting normal or abnormal based on its network and host interactions and activities. With the help of Machine Learning (ML), single entity normal behavior profiling and anomaly detection have been studied and improved extensively in recent years in the cybersecurity domain. However, fewer works consider profiling group behavior of multiple entities as their objective. This is due to the high dynamicity and complexity of the virtualized system, where this complexity is exacerbated with consideration of group behavior profiling, which requires a global view of the system. The main objective of this project is to investigate, design, and evaluate machine learning approaches to support the detection, identification, and localization of malicious anomalies in complex virtualized infrastructure deployed in 5G edge and core networks.