Deep Learning Based Proactive Anomaly Detection for 5G Core Control Plane Network Function Interactions

The Service-Based Architecture (SBA) introduced by 3GPP allows the control plane of 5G Core Network (CN) to function through a set of interconnected Network Functions (NFs), which offers significant benefits such as improved scalability, simplified operations, and efficient resource utilization. However, such a new transformation could also make critical NFs in 5G CN become more susceptible to attacks due to both internal vulnerabilities within the software-implemented NFs or the expanded interfaces brought by the SBA. Existing studies targeting 5G network security pay little attention to the detection of abnormal behaviors from control plane NFs. Therefore, in this paper, we propose 5GCGuard, an anomaly detection scheme aiming at identifying abnormal NF interactions in 5G CN. It employs a deep learning-based sequence model to learn normal interaction patterns and detects anomalies based on deviations from the learned pattern. Special designs including attention mechanism, multi-task learning, probabilistic labeling and automatic threshold decision are made to enhance its detection capabilities. We establish a cloud-native 5G testbed to evaluate the effectiveness of 5GCGuard. Extensive evaluation results show its superiority over comparison schemes. Case studies also demonstrate its ability to proactively detect various NF interaction anomalies, enabling swift action to block attacks and prevent further damage.