Leveraging artificial intelligence for detection of denial-of service attacks in 5G network environments

Abstract

This research introduces an evaluation methodology that addresses the data leakage problem for detecting denial-of-service attacks in fifth-generation (5G) network slicing environments, and applies it to perform a benchmark comparison among twelve machine learning (ML), deep learning (DL), and probabilistic models using a publicly available 5G network slicing dataset for DoS/DDoS attacks. This methodology strictly enforces the execution of all preprocessing steps exclusively on the training data, where feature selection is performed using the mutual information (MI) metric, values are standardised via the z-score method, and synthetic samples are produced through the synthetic minority oversampling technique (SMOTE) technique on the training set only, with MI recalculated independently within each cross-validation (CV) cycle. Nine features out of eighty-four were retained at the elbow point where MI reached 0.51 or above. On the held-out test set containing approximately eighty percent benign data and twenty percent attack data, the convolutional neural network (CNN) model achieved the highest F1 value of 0.983 with a false discovery rate of 0.027, while the random forest model reached an F1 value of 0.968 at a considerably lower computational cost. All results remain tied to this particular dataset, and their generalisability to real-world 5G network traffic has not yet been validated.