Towards the detection of mobile DDoS attacks in 5G multi-tenant networks

The fifth-generation (5G) mobile networks target a variety of new use cases that involve a massive amount of heterogeneous devices connected to the same infrastructure. This trend also brings new security threats, and one of the most critical ones for the availability of network services is a Distributed Denial of Service (DDoS) attack. A small portion of the billions of connected devices can be employed as a botnet to trigger a massive DDoS flooding attack that can bring down important services or affect the complete infrastructure. Traditional security systems against DDoS attacks are generally designed to work in infrastructures with a particular topology. However, the mobility of many devices subscribed to the network should be taken into account when designing defence systems. Otherwise, both the detection and the trace back of the attacker will be limited to non-mobile devices as the source of the attack. This is specially relevant when security needs to be part of the definition of the network slices associated to the 5G networks. This paper presents a novel approach to overcome the limitation of traditional detection systems. A novel sensor provides the required information to trace back an attacker even if it is moving among different locations. The proposed approach is suitable to be deployed in almost all 5G network segments including the Edge. Architectural design is described and empirical experiments have validated the proposed approach.