Intrusion Detection and Prevention

Basic Technologies

The subject of ongoing research is to determine the best architectural model for designing 5G data transmission networks. However, any architectural design must take into account two points of view. Data perspective deals with real-time data analysis that uses software-based frontend data paths, while the management perspective deals with the suitable administration of the network components and the associated services that they define. It must be mentioned that the structure of a 5G data transmission network must take into account considerable technical requirements, such as scalability and the ability to virtualize network functions, when implementing network resources and providing necessary capabilities to virtualize network functions. Therefore, comprehensive functional requirements must be accessible to support effective network management. This should include the effective setting of guidelines under which mobile devices will behave optimally, defining a policy to control access to network resources, and the ability to virtualize given physical network resources.

Virtualized Wireless Network Function

VWNF, the virtualized wireless network function, is the main function in the design and implementation of 5G data networks. It is effectively used to design 5G network's core (5GC). The process is able to logically define a self-sufficient 5G data network using NFV, network function virtualization. The basic technology of 5G is visualized on Figure 1. It is worth noting that the mentioned process is important from both a theoretical and a research point of view. In addition, it allows the deployment of dedicated 5G networks in certain infrastructures, such as telecommunications or cloud providers, which provide network services. We effectively worked with this system to realize particular network services in the 5G data network of the relative telecommunications service provider. Thus, during implementation, we noticed that the virtualized network environment has the necessary logical plasticity and scalability, which allowed us to effectively develop an intrusion detection system in real-time. Network virtualization model is visualized in Figure 2. In fact, we have determined that virtualization engine provides the ability to properly handle data streams passing through the 5G network to detect potential or known threat patterns. Figure 1 describes the application of the virtualized networking mechanism. By means of design, realization, and deployment of a real-time intrusion detection system (IDS), we demonstrated that this system is appropriate for the correct formation of the needed dedicated virtual data network, which by itself confirms the conclusions outlined in paper.

In Figure 2, let us particularly note the mobile fronthaul and the mobile backhaul components. In its simplest form, the backhaul connects the mobile network to the wired network by backhauling traffic from geographically dispersed cell sites to mobile switching telephone offices (MTSOs). These links, which interconnect macro cell sites (e.g., sites housing those large towers that you can easily see at great distances) to MTSOs, are quickly migrating from slower TDM-based T1/E1 connections towards packet-based Ethernet-over-fiber links, typically via 1Gbps+ physical interfaces to the macro cell site. Within a typical macro cell site resides a baseband unit (BBU) connected to a radio unit (RU). The former processer uses and controls data, while the latter generates radio signals transmitted over the airwaves via tower-mounted antennas.

Furthermore, the fronthaul is associated with a new and different type of radio access network (RAN) architecture consisting of centralized baseband controllers and standalone radio heads installed at remote cell sites located kilometers to tens of kilometers away. These BBU and RU functional blocks, as well as the equipment that performs these functions, are located further away from each other than in the mobile backhaul model.

In the fronthaul model, the RU equipment is now referred to as a remote radio head (RRH) but is still located at the cell site. The BBU is now located in a centralized, protected location where it serves multiple RRHs. The optical links that interconnect the newly centralized BBU and the multiple RRHs are referred to as fronthaul. In Figure 3, the logical features of this architecture are presented.

Figure 3. Logical architecture of the fronthaul and backhaul.

We also found that the 5G networks' logical characteristics optimize the distribution and use of radio resources, as we identified logical subnets that separately analyze data traffic through separate intrusion detection instances in real-time.

So, obtained results broadened and improved the work presented in "A Survey of Clustering Techniques in WSNs and Consideration of the Challenges of Applying Such to 5G IoT Scenarios.". Our test work shows that correctly defined 5G virtual networks can support applications that operate with huge amounts of data such as real-time IDSs.