Now 5528 visitors
Today:0 Yesterday:0
Total: 148260 212S 50P 4R
2026-10-20, Week 43
Member Login
TACT Journal Homepage
Call for Paper
Committee
Find My Paper
Author Homepage
Statistics & History
Welcome Message
Paper Procedure
FAQ
Paper Archives
Outstanding Papers
Program & Proceedings
Presentation Platform
Hotel & Travel Info
Photo Gallery
Scheduler Login
Seminar
Archives Login
Sponsors


















Presentation Assistant Go to [Q&A Session]
Paper Number
Paper Title
Keyword
ICACT20210225 Slide.01        [Big Slide] Chrome Click!!
Hi everybody, my name is Gyeoul Lee. My presentation today is about a Network Flow Data Recollecting Approach Using 5G Testbed for Labeled Dataset.
ICACT20210225 Slide.02        [Big Slide] Chrome Click!!
The first slide is abstract.
ICACT20210225 Slide.03        [Big Slide] Chrome Click!!
This announcement is organized as follows: First, we will introduce the background information and architecture of 5G test bed for network security. Second, it provides 5G network data used for the test bed. Third, we present the data collected in the model factory and re-collection environment. And the implemented test bed is used to describe the labeling methodology. Finally, conclusions and future work are discussed.
ICACT20210225 Slide.04        [Big Slide] Chrome Click!!
In this study, to observe 5G features for network security, we implemented a 5G testbed that can collect the network flow data by replaying various network data in 5G environments. To build the test environments for 5G network features, we designed and constructed a testbed that is primarily composed of three systems: a 5G Core network (5GC), gNodeB (gNB), and user equipment (UE)
ICACT20210225 Slide.05        [Big Slide] Chrome Click!!
We collected network flows from a model factory that uses 5G networks. Subsequently, the collected data were replayed on the 5G testbed described above. Based on the 5G network structure, the implemented 5G testbed comprised a UE–MT for wireless communication, a UE as a user terminal, a UE–DM for verifying the UE’s status, a gNB as a base station, and a gNB–DM for verifying the gNB’s status. Fig. 2 shows the components for our implemented testbed. The UE–MT and gNB are radio sections that are connected to the AMF through the N2 interface, and a data transmission device is connected to the UPF through the N3 interface. In the 5G testbed, SCTP and UDP protocols are primarily used in the gNB and 5GC sections, and data passing through the section is tunneled to the UDP with a 4-byte header. The backhaul network comprises network elements and communication channels between the gNB as the base station and 5GC as the core network. In particular, similar to 4G LTE, these channels are encapsulated by a tunneling protocol, which is typically known as GTP. Because of the tunneling mechanism, when the network collector captures the network raw data, the original end-to-end network information is contained to the payload data of the captured data instead of to the IP. Therefore, to be aware of the original network information, the tunneled header must be eliminated, except in some cases. In the case of control plane data similar to SCTP, because they are not designed to be encapsulated, the tunneling header must be maintained. Hence, we developed a specialized network collector system that can extract the original end-to-end network features to collect network traffic through tunneling in a 5G network. The network collector was positioned between the gNB and 5GC.
ICACT20210225 Slide.06        [Big Slide] Chrome Click!!
We performed an ICMP ping test to the gateway from one host that is positioned in the core network scope in the testbed. We observed that the ICMP packet comprised eight bytes for the ICMP header, 20 bytes for the IP header, 24 bytes for the Ethernet header, and 32 bytes for the payload, as shown in the figure
ICACT20210225 Slide.07        [Big Slide] Chrome Click!!
Figure presents the structure of the tunneling packet. The structure of the tunneling packet captured between the base station (gNB) and the 5G core network comprised 20 bytes for the IP header, eight bytes for the UDP header, and four bytes for the tunneling header, similar to the GTP. The original data were encapsulated in 60 bytes of payload and are not shown herein.
ICACT20210225 Slide.08        [Big Slide] Chrome Click!!
As shown in Figures, a typical ping packet comprises a payload, which is transmission data, 14 bytes for an Ethernet header, 20 bytes for an IP header, and eight bytes for an ICMP header. In the 5G network, the ping packets collected from the gNB and the 5GC section are encapsulated with the tunnel header. Additionally, it contains the 5GC and gNB’s IPs as the source and destination IPs, respectively.
ICACT20210225 Slide.09        [Big Slide] Chrome Click!!
To replay the 5G testbed built by collecting actual data from the model factory, an additional task of removing the tunnel header is required. This task was performed by the network collector. Figure shows the flow with the tunnel header removed by the collector.
ICACT20210225 Slide.10        [Big Slide] Chrome Click!!
For real data collection, we positioned the network collector in one model factory, as shown in this page. The network collector collects traffic between the base station gNB and 5GC. Figure shows the structure of packets collected in the model factory. The source and destination IPs of all packets are the gNB and the 5GC’s IPs, respectively. The 5G network encapsulates the original source IP and destination IP with a 4-byte tunnel header in the UDP protocol. The network collector collects traffic between the model factory’s gNB and the 5GC. It is capable of storing the traffic data after removing the tunnel header of the packet. By eliminating the GTP tunnel header of the collecting packet, the original source IP and the destination IP can be extracted for analyzing network flow.
ICACT20210225 Slide.11        [Big Slide] Chrome Click!!
In Fig, the IPs of the source and destination of packets collected in the gNB and the 5GC section were the IPs of the gNB and 5GC, respectively. Because they are tunneled, they cannot be executed in other environments even when the flow is collected. So, we positioned the network collector in the model factory. It is capable of storing the traffic data after removing the tunnel header of the packet. By eliminating the GTP tunnel header of the collecting packet, the original source IP and the destination IP can be extracted for analyzing network flow.
ICACT20210225 Slide.12        [Big Slide] Chrome Click!!
Building a successful machine learning model that can recognize cyber threats requires large amounts of training data. Building labeled datasets for 5G network security is significant and essential. Therefore, we collected network data from the 5G-based real smart-factory to build the datasets. Subsequently, we replayed the traffic on the 5G testbed that we built and re-collected the generated traffic. ~~~ We implemented modified packets on the 5G testbed which comprised a user terminal composed of N virtual machines, a 5GC, and a gNB that replayed normal and abnormal data collected based on the 5G network. Subsequently, the data generated in the testbed were re-collected by the collector. By repeating collection and replay, a dataset for AI-based intrusion detection was created.
ICACT20210225 Slide.13        [Big Slide] Chrome Click!!
~~In the experiment, the data generated in the model factory were applied to the testbed. We observed that the generated data can be replayed and re-collected on the 5G testbed to build a dataset.
ICACT20210225 Slide.14        [Big Slide] Chrome Click!!
We implemented a dataset conversion tool that can assist in labeling the data records, as shown in Figure. The operating procedure of the dataset conversion tool for labeling data records is as follows: First, in one model factory comprising a gNB, 5GC, and UE, we collected the network data by performing simulated attacks using an actual UE. At this time, the network collector instantly stored raw network data using data collected through simulated attacks and abnormal behaviors in the same manner as in actual collections. Second, in the 5G testbed comprising a UE composed of N virtual machines, a gNB, and a 5GC, we replayed normal and abnormal data collected in the 5G network. The network collector stored the data collected at this time. In addition, using a network packet replay program such as tcpreplay, it must change the packet’s source IP and source MAC, destination IP, and destination MAC. Subsequently, they were transmitted to the 5G tunneling section, which is known as backhaul. Third, when the replayed and collected data exhibit similarity exceeding a threshold value during a simulated attack, the data can be labeled as attack data. In addition to this similarity threshold, our implemented data tool can perform labeling based on network session information, the source IP group, the destination IP group, and attack timestamp information.
ICACT20210225 Slide.15        [Big Slide] Chrome Click!!
Herein, we proposed a testbed specialized for 5G network data collection that can replay attack data and ensure network security. Additionally, a network collector was designed and implemented to address the limitation due to the tunneling issue when extracting network flows. The purpose of the testbed was to collect real 5G data and build a dataset for AI learning using the collected data. The collected network data can be converted to a labeled dataset using the implemented dataset conversion tool. We collected network data by performing simulated attacks using an actual 5G user equipment in one smart factory, and by replaying the collected data, we iteratively collected the network data. Using the data from the proposed methodology, we constructed a labeled dataset that can be utilized as learning data for supervised learning methods. In the future, to address the evolving problem of 5G edge cyberattacks, we will develop a 5G security solution for enhancing intelligent network security using the proposed re-collecting approach and various AI technologies
ICACT20210225 Slide.16        [Big Slide] Chrome Click!!
Thank you