L2M NSERC - Intrusion Detection System for 5G Network Slices

现代通信网络正从集中式架构转向分布式架构，以支持用户的异构需求。例如，5G网络设计采用微服务架构，每个核心网络功能只有一个职责。这些核心功能分布在整个网络中，增加了攻击面。此外，这种现代网络架构引入了一种全新类型的入侵攻击（又名零日攻击）的可能性，这是以前从未见过的。在这里，入侵攻击意味着对网络的未经授权访问，这可能被用于进一步的数据泄露。使用入侵检测系统（IDS）是检测网络入侵的一种典型方法。现有的入侵检测方案在分布式入侵检测方面存在不足。该项目旨在推进最先进的IDS解决方案，以应对现代网络新架构带来的挑战。数据驱动技术，如机器学习（ML）已被用于检测零日攻击。我们提出的解决方案将使用机器学习尽早检测入侵。此外，我们计划使用联邦学习在整个网络中以分布式方式应用我们的解决方案。联邦学习是一种技术，它使ML模型能够从分布在不同位置的更广泛的数据中学习。通过将早期检测与联邦学习相结合，我们的项目旨在减少从分布式服务器到网络中央数据中心的数据移动，从而促进有效ids的开发。

Modern communication networks are shifting towards distributed architecture from centralized ones to support the heterogeneous needs of consumers. For example, the 5G network design adopts the microservice architecture, for which each core network function has only one responsibility. These core functions are distributed across the network, which increases the attack surface. Furthermore, this modern network architecture introduces the possibility of an entirely new type of intrusion attack (a.k.a zero-day attack), which has never been seen before. Here, an intrusion attack means unauthorized access to the network, which can be exploited for further data breaches. The use of an intrusion detection system (IDS) is a typical way of detecting intrusion in a network. The existing solutions for intrusion detection fall short in detecting intrusion in a distributed manner. This project aims to advance state-of-the-art IDS solutions to address the challenges introduced by the new architecture of modern networks. Data-driven technologies such as machine learning (ML) have been used to detect zero-day attacks. Our proposed solution will use ML to detect intrusion as early as possible. Furthermore, we plan to use federated learning to apply our solution in a distributed manner across the network. Federated Learning is a technique that enables a ML model to learn from a broader range of data that is distributed across different locations. By combining early detection with Federated Learning, our project seeks to reduce the data movement from the distributed servers to the central data center of a network to facilitate the development of effective IDSs.