Towards 5G-ready Security Evaluation

进入第五代(5G)时代，电信网络表现出一些前辈们看不到的特征，使托管IT基础设施的安全态势变得复杂。例如，存在共享平台的更多方，例如虚拟运营商，并且网络实体可以动态地出现/消失。虽然已经有各种成熟的解决方案来检测、缓解、预防和分析网络攻击，但评估其可能性在IT行业一直是一个长期的探索。这关系到重要的决策，例如应该将更多的投资投向哪里以及如何部署网络功能。尽管对此类攻击的准确预测不是微不足道的(如果可能的话)，但我们的目标是至少拿出一个比较的基础。有了这样的基础，决策者可以看到，在X的假设下，系统/基础设施A比B更安全。在这个项目中，我们考虑了5G的特定特征，并在安全评估的背景下对攻击和防御机制等各种因素进行了重新建模。例如，我们使用分层模型来表示5G实体，并提出了一种模块化的方法来聚合各方的安全指标，以获得总得分。此外，我们将确定新的措施，以协助进行安全评估。三个试探性的方面是1)5G网络实体的元数据。大多数5G实体基于可以自动实例化的虚拟化/基于云的网络功能。定义它们的元数据具有安全含义。2)机器学习。无需手动选择安全指标，我们就可以使用神经网络等方法，根据当前的专家知识自适应地指示安全级别。3)基于用户的验证。由于安全评估总是关乎未来(例如，概率)，用算法来证明或证伪并不容易或不那么直接。我们还计划纳入用户意见以便于验证。作为另一个差异化因素，我们的实验和评估基于真实的虚拟5G试验台。

Entering the era of the fifth generation (5G), telecom networks demonstrate certain characteristics less seen in the predecessors, complicating the security posture of the hosting IT infrastructure. For example, there are more parties sharing the platform, e.g., virtual operators, and network entities can appear/disappear dynamically on the fly. While there have been various well-established solutions to the detection, mitigation, prevention and analysis of cyber-attacks, evaluation of their probability has been a long quest in the IT industry. This concerns important decisions such as where more investments should go and how network functions should be deployed. Even though accurate prediction of such attack is non-trivial (if possible at all), we aim to at least come up with a basis for comparison. With such bases, a decision maker can see that system/infrastructure A is more secure than B, under the assumption of X. In this project, we take into account the 5G-specific characteristics and remodel various factors like attacks and defense mechanisms under the context of security evaluation. For instance, we use a layered model to represent 5G entities and propose a modular approach to aggregate security metrics of individual parties to have an overall score. Moreover, we will identify new measures to assist in security evaluation. Three tentative aspects are 1) Metadata of 5G network entities. Most 5G entities are based on virtualized/cloud-based network functions that can be automatically instantiated. The metadata that defines them has security implications.2) Machine learning. Without manually selecting security indicators, we can use methods like neural networks to self-adapt to indicate security levels, based on current expert knowledge. 3) User-based validation. As security evaluation always concerns the future (e.g., the probability), it is not easy or less straightforward to prove or falsify with algorithms. We also plan to also involve user opinions to facilitate the validation.As another differentiator, we base our experimentation and evaluation on real virtualized 5G testbed.