Inter-Slice Defender: An Anomaly Detection Solution for Distributed Slice Mobility Attacks

With the evolution of Fifth Generation (5G) technology, network slicing has become a key enabler, providing flexibility and efficiency in segmenting the network to enhance service delivery. This technology enables User Equipment (UEs) to simultaneously connect or switch between Network Slices (NSs) to get access to multiple services with guaranteed quality of service. Nonetheless, switching between NSs, also known as Inter-Slice-Switching (ISS), can be maliciously exploited by attackers to cause a Distributed Slice Mobility (DSM) attack. DSM attack is a distributed denial of service attack that can disrupt both NSs and the 5G control plane. In this work, we develop Inter-slice defender, a novel Long ShortTerm Memory (LSTM)-Autoencoder-based anomaly detection solution, tailored to detect DSM attacks. Inter-slice Defender leverages Third Generation Partnership (3GPP) Key Performance Indicators (KPIs) and Performance Measurement (PM) counters to detect two variations of the DSM attack that we devise. Our experimental results are based on DSM attacks simulations performed on a 5G testbed employing the opensource Free5GC testbed and UERANSIM simulator. They show that Inter-slice defender achieves an average F1-score of 98.75%, demonstrating its robustness in detecting these sophisticated attacks.