Unsupervised Graph-Sequence Anomaly Detection for 5G Core Network Control Plane Traffic

5G Core network (5GC) employs a Service Based Architecture (SBA). This architecture decomposes the control plane into multiple independent Network Functions (NFs). NFs open interfaces to provide services to other NFs, which makes the control plane more susceptible to external malicious attacks. However, existing anomaly detection methods focus more on traffic statistics features and are difficult to apply to the 5GC control plane. In this paper, we proposed GSAD, a Graph-Sequence analysis-based Anomaly Detection method for 5GC control plane traffic. We model control plane traffic as a directed graph to depict topological and NF interaction information. Further, we use the normalizing flows with temporal dependencies to mine the sequential information in the traffic. GSAD combines the topological and sequential information to provide fine-grained detection. We evaluate our proposed framework on the 5GC testbed using Free5GC and UERANSIM in various scenarios. Experimental results demonstrate that our framework outperforms the baselines significantly in terms of detection performance.