A Novel AI/ML SIEM as Application Function within Private 5G Core Network for Industrial-IoT

The adoption of private 5G networks and the proliferation of Industrial Internet of Things (IIoT) devices utilizing low-power protocols (such as CoAP, LWM2M, MQTT) have unveiled challenging new security vulnerabilities. The latters are particularly significant at private industrial edge servers, which are directly connected to the 5G core network via the N6 interface. Traditional security solutions fall short in effectively monitoring and analyzing industrial protocols, rendering critical systems vulnerable to cyber threats. The consequences of successful attacks on IIoT devices in these environments can result in severe operational disruptions, financial losses, safety compromises, and environmental hazards. Existing measures are inadequate for protecting the N6 interface and edge environment. In this article, we introduce a 3GPP-compliant Application Function SIEM Alerting Agent. This specialized security solution is designed to detect and mitigate malicious IIoT traffic on private 5G networks at the edge, specifically targeting low-powered industrial protocols. Our proposal makes of advanced AI/ML anomaly detection and protocol analysis algorithms adhering to 3GPP R17 standards for seamless 5G integration. Through a private 5G experimental platform replicating an industrial setting, we collect traffic and system event and logs using only industrial protocols such as CoAP, LWM2M, and MQTT. Based on extensive experimentation with private 5G AMARISOFT platform, our proposal excels at detecting threats at the N6 interface.