Towards 5G-ready Security Evaluation

进入第五代（5G）时代，电信网络呈现出一些前人所不具备的特征，使托管IT基础设施的安全态势复杂化。例如，有更多的各方共享平台，例如虚拟运营商，网络实体可以动态地出现/消失。虽然已经有各种行之有效的解决方案来检测、缓解、预防和分析网络攻击，但对其概率的评估一直是IT行业的长期追求。这涉及到一些重要的决策，比如更多的投资应该投向哪里，以及网络功能应该如何部署。尽管对此类攻击的准确预测并非微不足道（如果可能的话），但我们的目标是至少提供一个比较的基础。有了这些基础，决策者可以看到，在x的假设下，系统/基础设施a比B更安全。在本项目中，我们考虑到5g特有的特点，在安全评估的背景下，对攻击、防御机制等各种因素进行重构。例如，我们使用分层模型来表示5G实体，并提出一种模块化方法来汇总各个方面的安全指标，以获得总体得分。此外，我们将确定协助安全评估的新措施。尝试性的三个方面是：1)5G网络实体的元数据。大多数5G实体都基于虚拟化/基于云的网络功能，可以自动实例化。定义它们的元数据具有安全含义。2)机器学习。无需手动选择安全指标，我们可以使用神经网络等方法根据当前的专家知识自适应地指示安全级别。3)基于用户的验证。由于安全评估总是与未来有关（例如，概率），因此用算法证明或证伪并不容易或不那么直接。我们还计划纳入用户意见，以促进验证。作为另一个区别，我们的实验和评估基于真实的虚拟化5G测试平台。

Entering the era of the fifth generation (5G), telecom networks demonstrate certain characteristics less seen in the predecessors, complicating the security posture of the hosting IT infrastructure. For example, there are more parties sharing the platform, e.g., virtual operators, and network entities can appear/disappear dynamically on the fly. While there have been various well-established solutions to the detection, mitigation, prevention and analysis of cyber-attacks, evaluation of their probability has been a long quest in the IT industry. This concerns important decisions such as where more investments should go and how network functions should be deployed. Even though accurate prediction of such attack is non-trivial (if possible at all), we aim to at least come up with a basis for comparison. With such bases, a decision maker can see that system/infrastructure A is more secure than B, under the assumption of X. In this project, we take into account the 5G-specific characteristics and remodel various factors like attacks and defense mechanisms under the context of security evaluation. For instance, we use a layered model to represent 5G entities and propose a modular approach to aggregate security metrics of individual parties to have an overall score. Moreover, we will identify new measures to assist in security evaluation. Three tentative aspects are 1) Metadata of 5G network entities. Most 5G entities are based on virtualized/cloud-based network functions that can be automatically instantiated. The metadata that defines them has security implications.2) Machine learning. Without manually selecting security indicators, we can use methods like neural networks to self-adapt to indicate security levels, based on current expert knowledge. 3) User-based validation. As security evaluation always concerns the future (e.g., the probability), it is not easy or less straightforward to prove or falsify with algorithms. We also plan to also involve user opinions to facilitate the validation.As another differentiator, we base our experimentation and evaluation on real virtualized 5G testbed.