 |
We implemented a dataset conversion tool that can assist in labeling the data records, as shown in Figure. The operating procedure of the dataset conversion tool for labeling data records is as follows:
First, in one model factory comprising a gNB, 5GC, and UE, we collected the network data by performing simulated attacks using an actual UE. At this time, the network collector instantly stored raw network data using data collected through simulated attacks and abnormal behaviors in the same manner as in actual collections.
Second, in the 5G testbed comprising a UE composed of N virtual machines, a gNB, and a 5GC, we replayed normal and abnormal data collected in the 5G network. The network collector stored the data collected at this time. In addition, using a network packet replay program such as tcpreplay, it must change the packet’s source IP and source MAC, destination IP, and destination MAC. Subsequently, they were transmitted to the 5G tunneling section, which is known as backhaul.
Third, when the replayed and collected data exhibit similarity exceeding a threshold value during a simulated attack, the data can be labeled as attack data. In addition to this similarity threshold, our implemented data tool can perform labeling based on network session information, the source IP group, the destination IP group, and attack timestamp information.
|
IEEE/ICACT20210225 Slide.14
[Big Slide]