Process-Based Anomalous Signaling Detection in 5G Core Network

This technical report presents a novel approach for detecting anomalous signaling in the 5G Core Network, specifically focusing on the N4 interface. The proposed method, termed PASD-5GC, integrates the Packet Forwarding Control Protocol (PFCP) business logic with behavioral patterns to enhance detection accuracy. The report outlines the vulnerabilities associated with the N4 interface, which is critical for managing signaling interactions between the control and user planes. It highlights existing detection methods that primarily focus on packet-level features, which often overlook contextual process information. The PASD-5GC approach aims to address these limitations by capturing both local and global features of signaling sequences through a core model called DM-Net. Experimental results demonstrate that PASD-5GC achieves a significant improvement in detection accuracy compared to traditional methods, validating its effectiveness in identifying anomalous signaling behaviors. The report emphasizes the importance of integrating business process information into anomaly detection frameworks to enhance security in the evolving 5G environment.