Abstract:Network slicing is considered as a key enabler for 5G and beyond mobile networks for supporting a variety of new services, including enhanced mobile broadband, ultra-reliable and low-latency communication, and massive connectivity, on the same physical infrastructure. However, this technology increases the susceptibility of networks to cyber threats, particularly Distributed Denial-of-Service (DDoS) attacks. These attacks have the potential to cause service quality degradation by overloading network function(s) that are central to network slices to operate seamlessly. This calls for an Intrusion Detection System (IDS) as a shield against a wide array of DDoS attacks. In this regard, one promising solution would be the use of Deep Learning (DL) models for detecting possible DDoS attacks, an approach that has already made its way into the field given its manifest effectiveness. However, one particular challenge with DL models is that they require large volumes of labeled data for efficient training, which are not readily available in operational networks. A possible workaround is to resort to Transfer Learning (TL) approaches that can utilize the knowledge learned from prior training to a target domain with limited labeled data. This paper investigates how Deep Transfer Learning (DTL) based approaches can improve the detection of DDoS attacks in 5G networks by leveraging DL models, such as Bidirectional Long Short-Term Memory (BiLSTM), Convolutional Neural Network (CNN), Residual Network (ResNet), and Inception as base models. A comprehensive dataset generated in our 5G network slicing testbed serves as the source dataset for DTL, which includes both benign and different types of DDoS attack traffic. After learning features, patterns, and representations from the source dataset using initial training, we fine-tune base models using a variety of TL processes on a target DDoS attack dataset. The 5G-NIDD dataset, which has a sparse amount of annotated traffic pertaining to several DDoS attack generated in a real 5G network, is chosen as the target dataset. The results show that the proposed DTL models have performance improvements in detecting different types of DDoS attacks in 5G-NIDD dataset compared to the case when no TL is applied. According to the results, the BiLSTM and Inception models being identified as the top-performing models. BiLSTM indicates an improvement of 13.90%, 21.48%, and 12.22% in terms of accuracy, recall, and F1-score, respectively, whereas, Inception demonstrates an enhancement of 10.09% in terms of precision, compared to the models that do not adopt TL.

Deep Learning-Based DDoS-Attack Detection for Cyber–Physical System over 5G Network

Intelligent DDoS Detection in Botnet Combined with Packet-Level Features under SDN

Deep Learning Based Attack Detection for Cyber-Physical System Cybersecurity: A Survey

5G Networks and IoT Devices: Mitigating DDoS Attacks with Deep Learning Techniques

Deep Learning based DDoS Attack Detection in Internet of Things: An Optimized CNN-BiLSTM Architecture with Transfer Learning and Regularization Techniques

Multi-Level Deep Neural Network for Distributed Denial-of-Service Attack Detection and Classification in Software-Defined Networking Supported Internet of Things Networks

An Efficient Deep Learning-Based Detection and Classification System for Cyber-Attacks in IoT Communication Networks

DTL-5G: Deep transfer learning-based DDoS attack detection in 5G and beyond networks

Cyber-Secure SDN: A CNN-Based Approach for Efficient Detection and Mitigation of DDoS attacks

A Deep Learning Based DDoS Detection System in Software-Defined Networking (SDN)

Towards the Detection of Mobile DDoS Attacks in 5G Multi-Tenant Networks

Real-Time DDoS Defense in 5G-Enabled IoT: A Multidomain Collaboration Perspective

A novel CNN‐based approach for detection and classification of DDoS attacks

Cybernet Model: A New Deep Learning Model for Cyber DDoS Attacks Detection and Recognition

LDoS Attacks Detection for ICPS NB-IoTs Environment via SE-Based CNN

Deep Learning-Based Approach for Detecting DDoS Attack on Software-Defined Networking Controller

LUCID: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

A Novel Supervised Deep Learning Solution to Detect Distributed Denial of Service (DDoS) attacks on Edge Systems using Convolutional Neural Networks (CNN)

DeepSecure: Detection of Distributed Denial of Service Attacks on 5G Network Slicing—Deep Learning Approach

Traffic Feature Selection and Distributed Denial of Service Attack Detection in Software-Defined Networks Based on Machine Learning

A novel optimization-driven deep learning framework for the detection of DDoS attacks