Intrusion Detection and Prevention

In this section, we describe the main design core of our system. In the system, we use entropy calculation in order to preprocess the data and apply the CNN model to it afterwards. All other modules give the system the opportunity to detect and classify the newly arrived data/malicious data and to take the decisions in milliseconds, which reflects the computational efficiency and the novelty of the offered approach. The IDS system's architecture consists of the following three layers: the data management and control layer, the machine learning-based data analysis layer, and the data traffic forwarding layer. The machine learning-based data analysis is trained using the dataset, which is a combination of different datasets. It includes DOS/DDOS datasets, KDD research datasets, and a dataset that was provided by a large telecommunications service provider. All the information is divided into 85% for training and 15% for testing and validation. Such splitting gave us the best accuracy. The received accuracy score is 0.9414. The presented model considers the convolutional neural network (CNN) model.

The design of our security system consists of four main functional stages:

The data forwarding layer is concerned with monitoring and collecting data traffic, which represents the first stage of the system. The data forwarding layer is capable of collecting and transferring streams of suspicious information to the control plane, and the intrusion prevention system (IPS) blocks the suspicious traffic of data by following the commands of the controller. This determines the second logical and functional stage of the system.

The data management and control layer recognize the malicious data patterns and identifies the anomalies by means of the analyses of intercepted data. After taking the appropriate security measures based on the detected patterns at the data analysis layer, it sends the information to the data transfer layer, which is the third stage of the system. This process is visualized on Figure 4.

Figure 4. The architecture of IDS and IPS.

The data forwarding layer, which determines the fourth functional stage, collects suspicious data patterns in real time and sends information to the data management and control layer. The IPS instantly blocks intrusions and sends the suspicious files to other system leers for checking. The package collection and data stream splitting layer ensures the entire 5G network's global view. The state control unit monitors the status of the data transmission network and analyzes the received data packets. The data management plane operates and analyzes data traffic. In addition, it creates appropriate bunches of data packets and produces the data fingerprint that tracks the succeeding logical network parameters: source port and the network protocol in question. The data fingerprint identifies the markings of different data flow records representing specific network connections. The gathering and inspection of the packets is done continuously. The time interval of data gathering and inspection is optimized to avoid undesirable latency in the data assessment process in real-time.

The pseudo-code of the basic part of the system can be seen bellow:

Packages are collected and checked permanently. Data acquisition and time intervals have been optimized to avoid possible unwanted retention in real-time data assessment.

The detection of anomalies is based on the basic data stream statistics that recognize potential anomalies. The specific IDS module employs entropy analysis by means of Shannon's theory to detect variation in the distribution of analyzed data packet selections.

Calculation of the entropy of a random variable r:

$H(r)=∑^{𝑛}_{𝑖=0}p(𝑟_𝑖)log𝑝(𝑟_𝑖)$

Here, p(r_i) denotes the probability that r will take the value r_i given all the values are already found. The equation takes into account four main parameters: source IP, source port, target IP address, and target port. The real-time traffic analysis component collects these values. Therefore, given a specific period of time, the constantly updated value provided by the entropy function H(r) assists in the discovery of probable patterns of malicious data packets. This continuously updated score is applied to all four considered networking parameters. Thus, this generates an aggregated entropy score, which allows for the traffic patterns to be classified with a high level of accuracy. Entropy is represented by E, and D indicates the standard deflection A possible suspect pattern suggests that H(r) is outside the range [(E − D), (E + D)]. Therefore, suspicious data is for additional analysis to the continuous layer of data analysis. The feature selector element creates and updates feature sets specific to detected patterns of malicious data. The section can work with huge data amounts in real-time when deleting irrelevant data features from the predictive data analysis layer. Therefore, the data can be categorized as appropriate, so that the patterns of malicious data packets are therefore detached from the patterns of harmless traffic. Table 1 shows the performance score that sets the five columns of the table. The performance score is calculated based on the input dataset, which is specified in the first column. The mentioned dataset contains 32 000 000 network connections that were checked by the intrusion detection system. Moreover, each connection object consists of thirty-nine functions which are checked by the machine learning (CNN) module of the IDS. The performance value indicators demonstrate that the mentioned system is well matched to the size of the checked dataset. In addition, the system is capable of identifying patterns of malicious traffic, minimizing the number of false positives. The behavior of the system in practice is principally important when using 5G data networks for commercial purposes.

It is relevant to mention that the described system proposes a unique machine learning-based 5G data traffic processing core (5GC). Furthermore, as the following section suggests, the maximum level of accuracy obtained is approximately 94%. The algorithmic model of the data traffic detection core should be further improved, so that the accuracy level should be in the range of 98–99%. This is justified by the necessity to reduce the unnecessary overload that is placed on the machine learning-based data traffic management components by incorrectly classifying benign data traffic patterns as malicious data traffic patterns.