Adaptive IQR-based unsupervised intrusion detection for DoS/DDoS attacks in 5G networks using deep autoencoders

Abstract

5th generation (5G) technology has led to widespread network deployment due to its ability to deliver ultra-low latency communication and huge device connections; however, it also has increased the overall cyber-attack surface for different attack types, including Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. Signature based intrusion detection systems (IDS) are not capable of identifying new and unknown attacks, whereas supervised machine learning models require a large set of labelled training data. As labeled attack data is typically unavailable in 5G networks, this paper explains an unsupervised anomaly detection framework that uses a Deep Autoencoder (DAE) trained only on normal (benign) traffic. Our framework identifies attacks by analyzing reconstruction errors and applies an adaptive Interquartile Range (IQR) based threshold to understand normal vs. abnormal traffic. Experiments on the 728,316 network flow samples that covers 9 DoS/DDoS attack categories of the 5G-NIDD dataset, shows that the proposed IQR-based approach offers a significant improvement compared with percentile and mean based methods in detecting attacks, and yields a high F1-score of 0.99 compared to 0.47 without retraining the model. Precision, Recall, F1-score and ROC-AUC values of the proposed framework are 97.66%, 99.89%, 98.79% and 97.87% respectively, and out of 321,357 attack instances, 321,012 are accurately detected. This demonstrated a powerful yet efficient approach by using unsupervised deep representation learning together with a simple and effective adaptive thresholding mechanism, also addressing the challenge of efficient and effective intrusion detection in current and future 5G wireless environments.