Machine Learning Isolation Forest-based Detection of Distributed Denial of Service Attacks on 5G Core Networks

Aug 3, 2026

Upload by Asher

Modern 5G and 6G networking ecosystems are increasingly heterogeneous, raising the likelihood of more capable cyber-threats and severe societal impact. Many threat actors are supported by governments, enabling advanced attacks that traditional perimeter security models struggle to address. This thesis develops a machine learning anomaly detection approach to defend 5G core networks, targeting control-plane attacks and Distributed Denial of Service (DDoS) scenarios. The method is intended to detect and mitigate unknown threats effectively.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages139

Reading Time5 h 50 min

AccessFree to download

Acknowledgement

Abstract

Keywords

Abbreviations

5G core networking and cyber threats

Control-plane targeting and DDoS context

Proposed machine learning anomaly detection approach

Machine Learning Isolation Forest-based Detection of Distributed Denial of Service Attacks on 5G Core Networks Guillermo Mikael Pabon Barbery Thesis submitted for the degree of Master in Applied Computer and Information Technology-ACIT (Cloud-based Services and Operations) 30 credits Department of Computer Science Faculty of Technology, Art and Design Oslo Metropolitan University — OsloMet Spring 2024 Machine Learning Isolation Forest-based Detection of Distributed Denial of Service Attacks on 5G Core Networks Guillermo Mikael Pabon Barbery © 2024 Guillermo Mikael Pabon Barbery Machine Learning Isolation Forest-based Detection of Distributed Denial of Service Attacks on 5G Core Networks [https://www.oslomet.no/](https://www.oslomet.no/) Printed: Oslo Metropolitan University — OsloMet Acknowledgement I would like to express my sincere gratitude to my supervisor, Bruno Dzogovic, for his patience, continuous support, and invaluable guidance throughout this research journey. Whenever I found myself stuck on a problem, Bruno was there with great suggestions and a calm demeanor that kept me motivated. His inspiration and wisdom have been pillars in shaping this thesis. I am truly grateful for the opportunity to work under his supervision and for him suggesting this fascinating research topic. I would also like to thank my family for their steadfast support and encouragement. My mom, sister, and brother have been there to listen whenever I was excited about my findings or frustrated by the challenges I faced. Their emotional support has been a driving force. Finally, I extend my appreciation to my fellow master’s students and dear friends, Frencis Balla, Andrea Grimsbo, and Anna Beruldsen. We spent countless days working together, each focused on our own projects but enjoying each other’s company. This shared experience has made this thesis all the more rewarding. ii Abstract In the modern networking landscape, with the emergence of 5G and 6G networks, the ecosystem has become increasingly heterogeneous. This added complexity also increases the potential for more prominent cyber-threats, resulting in more devastating consequences for society. Many threat actors are being funded by governments, enabling them to perform more sophisticated attacks that existing perimeter security models are unable to tackle. Consequently, better solutions are required to detect and mitigate these unknown threats. In this thesis, we propose a novel anomaly detection method based on machine learning that can be utilized to defend 5G core networks. The proposed approach is designed to address situations where threat actors target the control plane and attempt to perform Distributed Denial of Service (DDoS) Attacks. Keywords: 5G; Machine Learning; Transformer-based model; AI; Mobile Networking iv Abbreviations 3GPP The 3rd Generation Partnership Project 5GC 5G Core AF Application Function AI Artificial Intelligence AMF Access and Mobility Management Function API Application Programming Interfaces APT Advanced Persistent Threats AUSF Authentication Server Function AUTN Authentication Token AV Authentication Vector BERT Bidirectional Encoder Representations from Transformers CDR Call Detail Record CISA The U.S. Cybersecurity and Infrastructure Security Agency CNN Convolutional Neural Network CNI Container Network Interface CPS Cyber-Physical Systems DBNs Deep Belief Networks DDoS Distributed Denial of Service DL Deep Learning DN Data Network DNS Domain Name System DoS Denial of Service DRC Deep Rudimentary CNN EASDF Edge Application Server Discovery Function ENISA European Union Agency for Cybersecurity ENT Enterprise Code EU European Union FQDN Fully Qualified Domain Name GAN Generative Adversarial Network EU GDPR General Data Protection Regulation gNB Next Generation Node B ICT Information and Communication Technology IDS Intrusion Detection Systems IMSI International Mobile

FAQs

What problem does the thesis address for 5G core networks?

It addresses detecting and mitigating unknown cyber threats, specifically Distributed Denial of Service (DDoS) attacks where threat actors target the control plane of 5G core networks.

What method is proposed in the thesis?

The thesis proposes a novel machine-learning-based anomaly detection method designed for defending 5G core networks against DDoS targeting the control plane.

Why are existing perimeter security models considered insufficient?

Because threat actors can perform more sophisticated attacks that traditional perimeter security models are unable to tackle, increasing the need for improved detection and mitigation solutions.

Aug 3, 2026

Upload by Asher