Analysis of Anomaly Detection and Identification Methods in 5G Traffic

Anomaly detection is an important task in 5G technology and many other areas of human life. In this paper, statistical methods of data analysis, such as survival analysis, time series analysis (fractal), classification method (decision trees), cluster analysis (DBSCAN), entropy method were chosen to detect anomalies. A description of the selected methods is given. Simulation modeling of these methods on the example of telecommunication network traffic was performed. As anomalies were chosen DDoS attacks, UDP-flood, TCP SYN, ARP attacks and HTTP flood. A comparative analysis of the performance of these methods for the identification of anomalies (attacks) on the probability of detecting anomalies, the probability of false positive detection, the running time of each method to detect the anomaly. Experimental results showed that the decision tree method is the best in all comparison parameters. The entropy analysis method is slightly slower, and it gives slightly more false positives. This is followed by the cluster analysis method, which is slightly worse at identifying anomalies. Then the fractal analysis method showed a lower probability of identifying anomalies, a higher probability of false positives and a longer running time. The worst was the survival analysis method.