Network Anomaly Detection in 5G Networks

5G technology deals with various technologies like spectrum sharing, Device to device (D2D), Ultra dense network (UDN) and massive Multiple input Multiple output (MIMO). User’s experience has high data rate, low latency, energy efficiency, spectrum efficiency, UDN, coverage dependability as well as mobility in the wireless communication network are some of the needs that 5G can meet [1]. Additionally, 5G is expected to provide a wide range of additional services, such as ultra-reliable, massive machine types of information exchange, increased mobile broadband and communication with reduced latency depending on the specific use-case. Interference mitigation, mode selection, device synchronization, security and quality of service are all issues that emerge when using device to device Long Term Evaluation/Advance LTE/LTE-A system [2] LTE is vulnerable to Radio Frequency (RF) jamming, spoofing, and sniffing, and examining the various physical layer vulnerabilities that could disrupt next-generation vital communication networks [3]. A wide range of machine learning algorithms can be used to attack anomaly detection challenges in 5G. In addition, most of them can be used in accordance with the VNO security policies specified in the proposed cyber defense architecture [4]. Network security in 5G is always a critical component in all business fields especially with the widespread cybercrimes in recent years. There are a lot of tools that can detect the pre-known attacks such as antivirus software, firewalls, and honeypots, but these tools are not enough because of the rapid expansion in the unprecedented attack methods and behaviors. This is mainly because of overwhelmingly increasing number of Internet of Things (IoT) devices and applications that can potentially induce the vulnerability. Furthermore, enhanced network heterogeneity, intensified use of virtualization technologies and distributed architectures make it nearly impossible to cope the situation [5]. Moreover, existing (say for 4G) Network Anomaly Detection (NAD) technique are not that effective for its 5G counterpart [4y]. Situation demands more robust and effective techniques with reduced complexity. This work presents the NAD in 5G networks which provides a high level of security by applying a persistent observation of network to detect any abnormal behavior from potential attackers that they signed up as legit users. There are a lot of methods that can be used to apply the NAD and most of them focus on analyzing the behaviors of the network traffic to apply the detection process. Behavioral analysis and prediction are among the hottest areas of research in many fields of studies like consumer marketing, social network, marketing, information security and many others. Rahman et al. [6] proposed a user behavior classification and prediction using a neuro-fuzzy approach. The analysis was made over the users logs duly obtained by a proxy server continuously monitoring the network user activities related to machine, ethernet and web browsing. Based on the company’s rules the restricted actions were mined out of the logs after due preprocessing. A Gaussian Radial Basis Function Neural Network (GRBF-NN) [7, 8] along with a Fuzzy Rule Based System [9, 10] was used to learn the examples provided by an added Differential Evolution (DE) block [11]. The scheme also incorporated user 360 feedback to jointly decide the user’s behavior. Similar work was carried out by Rahman et al. [12, 13] by using linear regression and FRBS, respectively. A hybrid approach for network anomaly detection and user behavior prediction was presented by Vadgaonkar [14]. The study investigated a machine learning based approach. The proposed approached claimed as significant accuracy over a predefined dataset in an offline mode. The network performance tools are widely used to continuously analyze the network traffic. However, the perspectives may be different. For example, the overall network performance is represented in terms of Network Availability, CPU and memory utilization, Traffic rate, number of errors and discards and Wide Area Network (WAN) performance. It is worth mentioning that the network anomalies may affect the network availability in terms of denial-of-service attacks (DoS) and Distributed DoS (DDoS) attacks, CPU and memory utilization may be overwhelmed by bots and memory resident viruses attacks duly penetrated by the network. Traffic rate can be compromised by the eavesdroppers and network attackers by inducing more traffic in the regular one. Collectively these factors can result in increase in errors in the data traffic and discards of requests. Thus, the network anomalies encompass all the factors and as a result overall network performance can become vulnerable. Several network analysis tools are available in market. However, their effectiveness is subjective and do not fulfill the requirements for all types of networks. Such as the tool developed for the earlier generations networks may not be that effective due to the variation in standard, data rates and application areas. It should rather be more customized per the organizational needs and type of data and its security [15]. In contrast, Network intrusion detection systems (IDS) have their own pros and cons on the other hand. For instance, the advantages include timely identification of intrusions that results in less security incidents. Similarly, as far as the disadvantages are concerned, the false positive incidents may result in denial of service (DoS) attack as a false alarm. Furthermore, if the concerned organization has poor bandwidth and network resources, it could result in slowing down the overall network traffic [16]. Moreover, IDS are signature based that requires a prior information about the signatures to be detected or identified. However, intrusion is one possible way to compromise the network behavior while there could be more [16].

Rest of the paper is organized as follows: the detailed description of the NAD in 5G background is presented in section 2, six different methods to apply NAD are reviewed section 3, and some methods that can be used in predicting the potential attacks before it occurs in section 4 and section 5 concludes the paper.

There are various ways that can be used to provide a high level of network security in 5G, this section describes six methods that can be applied to achieve the network's behavior anomaly detection process.

3.1 Pattern-based random walk

Random Walk term refers to the process of randomization to construct a path of n steps (points). For the sake of clarity, assume there is an agent that needs to traverse a path that consists of some points and in each step (point), the agent chooses its direction randomly. Figure 1-a shows a path that the agent would take from the source to the destination without any restricted rules and it may be stuck in a loop (points A and D). Moreover, to predict the walker’s behavior in a simple Random Walk we need to calculate the probability of being at a specific point after walking for n steps. This theory used to simulate the random behaviors in computer networks, and it describes only the typical computer system model. In addition, more features should be added to the Random walk to conduct the simulation in more complex computer systems and networks, and that presents the Self-avoiding Walk which is a new type of random walk that simulates the activities in computer networks with some additional rules. The main rule is to limit the walker behavior by disallowing it to revisit the visited points before as described in Figure 1-b, and that would make predicting the walker behavior more accurate. It is important to analyze any network traffic in 5G to identify it to either a pre-known threat then store it in the attack database or classify it as normal traffic. But this is not enough since there is always a new generation of unprecedented threats that must be identified using a pre-known attack database. For the previous reason, Pattern-based Random Walk which is considered as a new customization of Random Walk was presented to detect these kinds of threats and analyze them accurately. The main advantage of this approach is outlier detection that can probably leads to an anomaly in the network. Pattern theory is one of the Self-avoiding Walk that used to determine whether patterns are matched together or not. Every income traffic must be checked and sampled, if it is not detected as one of the pre-known behaviors, the sample should be flagged, and an analysis process should be done on this flagged sample. After that, a self-explained graph will be generated that does not need any more information, and this graph should be compared with some similar pre-known patterns to decide whether there are matched patterns or not. If any, then system should take the proper decision [26].

1.png

Figure 1. (a) Simple random walk (b) Self-avoiding walk

3.2 Immune network and density peak

It is an unsupervised NAD method in 5G, it was presented to identify the unknown malicious attack behavior from any network flow in the Internet environment. There are some models and algorithms which includes the Artificial Immune Network (aiNet) model, the clustering algorithm based on density peak (CDP), the clustering labeling algorithm (CLA), and the flow anomaly detection algorithm (FAD). It works by obtaining network flows as a starting point. Next, it selects the common features of the network flows since that will help in recognizing anomaly or malicious behaviors easily. Then, clusters the network flows which includes two phases, the coarse-grained phase, and the fine-grained phase. The coarse-grained phase includes using the aiNet model to cluster the samples from the given dataset and this process work by analyzing and filtering the samples. The fine-grained phase includes using the CDP algorithm to cluster the output of the aiNet clustering and this process work by refining the cluster centroids from the coarse-grained phase. After that, it uses the CLA to label the resulted clusters as normal or abnormal detectors and uses them to distinguish between malicious and benign behaviors. The cluster labeling step is very significant since its results will affect its performance. Finally, providing the functionality of anomaly detection for the network flows using FAD since that will play a role in enhancing the network security [27]. It can be deduced from the discussion that there are certain similarities and difference among these algorithms. As far as similarity is concerned, their ultimate task is to detect the abnormalities in the particular network traffic. While differences include in such a way that one algorithm is best in one way and the other is in another way. For instance, the aiNet implies a coarse-grained clustering algorithm to extract the abstract internal patterns of network flows, and the CDP signifies a fine-grained clustering algorithm to obtain more precise cluster number and cluster centroids. A study [27] proposed a NAD approach coined as Artificial Immune network and Density peak (ADAID), that combines aiNet and CDP for better results in terms of improved accuracy rates and reduced false alarm rates.

3.3 Hybrid data optimization based on ML algorithms

Intrusion detection system (IDS) can also detect anomaly behaviors in the 5G network. This work produced an effective IDS by using data optimization which consists of two main sections: extract samples from dataset and select common features from these data, named DO-IDS. The Isolation Forest (iForest) is used in extract random sample to eliminate outliers in dataset and reduce the negative effect of unbalanced data, after generating the sample genetic algorithm (GA) it used to optimize the sampling ratio, and the Random Forest (RF) classifier as the evaluation criteria to gain the optimal training dataset. After optimizing the extracted sample feature selection is used to search for features that reflect the difference between anomalous behaviors and normal behaviors and delete unrelated features to enhance the detection performance, GA and RF are used again to obtain the optimal feature subset. More specifically GA and RF complements each other in the weak areas to counter the issue of unbalanced dataset examples and fine tuning the significant features. After the optimum training dataset and the feature subset are selected, those will be occupied into the classifier training phase which uses RF algorithm. The whole process is shown in Figure 2 [28].

2.png

Figure 2. Process of DO IDS

3.4 Multi-view ensemble learning

This work proposes a malware detection scheme based on ensemble learning which is a concept that been used a lot in recent years. This concept can also be used for malware detection in 5G. It is multiple models, such as classifiers or experts combined to solve a particular computational intelligence. Ensemble learning is primarily used to enhance prediction, classification performance of a model, or reduce the likelihood of errors and low accuracy results. problem [29-32]. In this work, three ensemble learning methods, and different ensemble strategies are employed to fuse multi-view features which they were:

Byte n-grams: It is syntactic patterns features that cover the entire binary executable program and without explicit semantic information.

Opcode n-grams: It is explicit semantic information were used as features for detecting unknown malware it is extracted only from the code section of portable executable (PE) file.

Format feature: It is explicit semantic information extracted from PE header, section header, import, and resource sections.

The benefits of the integrated learning methods over the other are that they adequately combine their strengths to complement the weak areas among them to overall increase the precision rate in NAD. Those methods partially capture the different information between malicious and non-malicious applications. Also, they are complementary for each other in extracting features. The procedure of this experiment was as follows: (i) First is to find a data representation which captures the information within a given feature view, obtain and select the optimal parameter of each feature subset. (ii) Design the scheme to incorporate three feature views. The schema uses each of feature views to construct different classifiers which are then combined using three ensemble methods. (iii) Two datasets are used to evaluate new malware detection performance and the generalization performance of the proposed scheme. Finally, the results show that the proposed scheme does enhance the performance of new malware detection [33].

5G sets a better standard for commandability and speed on phones and other devices, as well as on the internet. Many of the security issues that plague today's 4G, 3G, and 2G networks have been addressed in 5G's design. Mutual authentication and identity protection are among the new measures that have been implemented. An unparalleled level of network and service security may be achieved with the introduction of 5G. Log Anomaly Detection may be savior. Logs are a terrific way to keep track of how your system is running. With the rapid development of technology in 5G as increases of using mobile devices which make societies open and connected to each other all day which makes the world a global village. Moreover, Intrusion detection has attracted the attention of many researchers in identifying the risks can affect network users. In this work, NAD was presented in detailed description which is a high level of security in 5G by applying a persistent observation of network to detect any abnormal behavior from potential attackers that they signed up as a legit user. Primarily, the current study can be useful for the scholars and researchers in the field of network intrusion and anomaly detection, as a head start in 5G. On the dataset, the KNN and K-prototype algorithms were put to the test jointly and compared to an integrated method. The integrated approach outperforms the KNN and K-prototype techniques in terms of predictive power. The higher security of 5G will lead to its higher suitability globally.