A Comparison Experiment of Binary Classification for Detecting the GTP Encapsulated IoT DDoS Traffics in 5G Network

Abstract

5G is characterized by ultra-low latency and the deployment of large-scale IoT environments. IoT devices with weak security can cause security problems such as network failures in 5G. To solve this problem, automated intrusion detection research using ML was being conducted. In previous studies, detection research using ML in the wired network environment was active, but it was relatively insufficient in the 5G network. In addition, the vast amount of traffic in IoT devices can create latency problems for intrusion detection with ML, making it difficult to achieve ultra-low latency 5G service objectives. Therefore, this study analyzed the meaning of the performance and required time of an optimized single ML model and ensemble learning experiment to detect in real time while ensuring high detection performance of large-capacity DDoS in 5G network. When the 5G GTP encapsulated traffic was collected and binary classification was performed, the optimized single ML model performed more than 99%. Especially, compared with ensemble learning, the experimental results showed similar performance and reduced detection time by at least 34 times. As a result of the experiment, it was shown that a single ML model optimized for detecting IoT DDoS in 5G with ultra-low latency is significant.