Method and apparatus for DDoS attack detection and mitigation in IoT network slices of 5G networks

A method for real-time and lightweight detection and mitigation of Distributed Denial of Service (DDoS) attacks in Internet of Things (IoT) network slices of a 5G network, the method comprising:

• implementing a 5G Service-Based Architecture (5G-SBA);
• identifying weakest points in an IoT slice through continuous monitoring of network behavior;
• turning the identified weakest points into one or more honeypots;
• monitoring, in real time at a gNodeB (gNB) and at one or more core network functions, a plurality of features including at least:
• data packets, outlier movement to critical slices, control/signaling messages, connection setup behavior, deviation from 5G Authentication and Key Agreement (5G-AKA), congestion, re-authentication frequency, abnormal slice switching, Access Mobility Function (AMF)/Session Management Function (SMF) overload, unnecessary slice switch requests, and wrong-time slice switch requests;
• applying a machine-learning or deep-learning based anomaly analyzer to the plurality of monitored features and declaring an attack condition upon detection of concurrent anomalies across the plurality of monitored features;
• and
• enforcing, via the AMF, the SMF, and a Policy Control Function (PCF), per-user equipment (UE) security policies including restricting slice switching, redirecting affected UE to a cleansing protocol data unit (PDU) session, and adjusting UE aggregate maximum bit rate (AMBR) via a user plane function (UPF).