Detection of Denial of Service (DOS) attacks against upstream devices based on wireless access network (RAN) signaling

Abstract

A method for detecting a denial-of-service (DoS) attack on an upstream device is provided, and the method is performed at a wireless network node. The method comprises: obtaining a metric based on radio access network (RAN) signaling for communication between user equipment (UE) and a wireless network node; and determining that a DoS attack is in progress on an upstream device based on the metric, wherein the upstream device is provided upstream from the wireless network node.

Description

Technology Field

[0001] The present disclosure relates to the field of detecting denial-of-service (DoS) attacks, and in particular to a wireless network node that detects DoS attacks against an upstream device based on RAN signaling. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks are becoming increasingly widespread. DDoS attacks are based on attackers gaining control of a vast number of devices connected to the Internet and thereby forming botnets. The penetration rate of IoT devices is continuously increasing. Potential security issues and the growing volume of IoT devices make IoT devices targets for attackers to create botnets capable of launching DDoS attacks against targets residing on the Internet.

[0003] There are several types of DDoS attacks. One example is the UDP flood volumetric attack. The UDP protocol is typically used for time-sensitive communications, such as voice, video, and game traffic. However, because the UDP protocol does not require a communication channel to be established before transmitting UDP packets, it can be used for volumetric attacks known as UDP flood attacks.

[0004] Similar to UDP overload attacks, TCP SYN (synchronize) message overload attacks result in high traffic volumes, although they have different characteristics.

[0005] Therefore, there are several types of volumetric attacks with high packet rates that attempt to cause the exhaustion of resources on servers and / or network links. UDP congestion attacks and TCP SYN attacks are types of DDoS attacks that send congested packets to a targeted server with the aim of overwhelming the server's ability to receive, process, and / or respond.

[0006] One objective is to improve the method of detecting DoS attacks.

[0007] According to a first aspect, a method for detecting a denial-of-service (DoS) attack on an upstream device is provided, and the method is performed at a wireless network node. The method comprises: obtaining a metric based on radio access network (RAN) signaling for communication between user equipment (UE) and a wireless network node; and determining that a DoS attack is in progress on an upstream device based on the metric, wherein the upstream device is provided upstream from the wireless network node.

[0008] The metric can be based on the volume of scheduling requests sent from the UE.

[0009] The step of determining that a DoS attack is in progress may include the step of determining that the volume of scheduling requests is smaller than the threshold volume of scheduling requests.

[0010] Metrics can be based on buffer status reports (BSRs) from the UE.

[0011] The step of determining that a DoS attack is in progress may include the step of determining that the frequency statistics of the BSR indicate a frequency greater than the threshold frequency.

[0012] The step of determining that a DoS attack is in progress may include the step of determining that the BSR indicates a high buffer level over time.

[0013] The metric can be based on the volume of physical resource blocks (PRBs) used.

[0014] The step of determining that a DoS attack is in progress may include the step of determining that the volume of PRB is greater than the threshold volume of PRB.

[0015] The method may further include a step of signaling an alert indicating that a DoS attack is in progress.

[0016] The step for determining that a DoS attack is in progress can be configured to detect a flood of user datagram protocol (UDP) packets.

[0017] The step of determining that a DoS attack is in progress can be configured to detect a flood of transport control protocol (TCP) synchronization (SYN) messages.

[0018] DoS attacks can involve user plane attacks.

[0019] According to a second aspect, a wireless network node is provided for detecting a denial-of-service (DoS) attack on an upstream device. The wireless network node comprises: a processor; and a memory for storing instructions, wherein, when the instructions are executed by the processor, the wireless network node obtains a metric based on radio access network (RAN) signaling for communication between user equipment (UE) and the wireless network node; and determines, based on the metric, that a DoS attack is in progress on an upstream device, and the upstream device is provided upstream from the wireless network node.

[0020] The metric can be based on the volume of scheduling requests sent from the UE.

[0021] A command to determine that a DoS attack is in progress may include a command that causes a wireless network node to determine, when executed by a processor, that the volume of scheduling requests is smaller than the threshold volume of scheduling requests.

[0022] Metrics can be based on buffer status reports (BSRs) from the UE.

[0023] A command to determine that a DoS attack is in progress may include a command that, when executed by a processor, causes a wireless network node to determine that the frequency statistics of the BSR indicate a frequency greater than a threshold frequency.

[0024] A command to determine that a DoS attack is in progress may include a command that, when executed by a processor, causes a wireless network node to determine that the BSR indicates a high buffer level over time.

[0025] The metric can be based on the volume of physical resource blocks (PRBs) used.

[0026] A command to determine that a DoS attack is in progress may include a command that causes a wireless network node to determine that the volume of PRB is greater than the threshold volume of PRB when executed by a processor.

[0027] The wireless network node may further include a command that causes the wireless network node to signal an alert indicating that a DoS attack is in progress when executed by the processor.

[0028] A command to determine that a DoS attack is in progress may include a command that causes a wireless network node to detect a flood of user datagram protocol (UDP) packets when executed by a processor.

[0029] A command to determine that a DoS attack is in progress may include a command that causes a wireless network node to detect a flood of transport control protocol (TCP) synchronization (SYN) messages when executed by a processor.

[0030] DoS attacks can involve user plane attacks.

[0031] According to a third aspect, a computer program for detecting a denial-of-service (DoS) attack on an upstream device is provided. The computer program includes computer program code, and when the computer program code is executed on a wireless network node, the wireless network node is configured to: obtain a metric based on radio access network (RAN) signaling for communication between user equipment (UE) and the wireless network node; and determine that a DoS attack is in progress on an upstream device based on the metric, and the upstream device is provided upstream from the wireless network node.

[0032] According to a fourth aspect, a computer program product is provided that includes a computer program according to a third aspect and a computer-readable means including a non-transient memory in which the computer program is stored.

[0033] In general, all terms used in the claims shall be interpreted according to their common meaning in the art unless otherwise explicitly defined herein. Any reference to "singular element, device, component, means, step, etc." shall be open to refer to at least one instance of the element, device, component, means, step, etc., unless otherwise explicitly stated. Unless otherwise explicitly stated, the steps of any method described herein do not need to be performed in the exact order described. Brief explanation of the drawing

[0034] Aspects and embodiments are now described with reference to the accompanying drawings. FIG. 1 is a schematic diagram illustrating an environment in which an embodiment presented in this specification may be applied. FIG. 2 is a schematic diagram illustrating an example of a distributed implementation of a wireless network node. FIG. 3 illustrates a protocol stack including a set of protocols for RAN communication between a UE (user equipment) and a wireless network node. FIGS. 4a and FIG. 4b are flowcharts illustrating an example of a method for detecting a DoS attack on an upstream device. Figure 5 is a schematic diagram illustrating the components of a wireless network node of Figure 1. FIG. 6 is a schematic diagram illustrating a functional module of a wireless network node of FIG. 1 according to one embodiment. FIG. 7 illustrates an example of a computer program product including computer-readable means. Specific details for implementing the invention

[0035] Aspects of the present disclosure will now be described more fully below with reference to the accompanying drawings, in which specific embodiments of the invention are illustrated. However, such aspects may be embodied in various forms and should not be construed as limiting. Rather, these embodiments are provided illustratively so that the present disclosure may be thorough and complete and so that the scope of all aspects of the invention may be fully conveyed to those skilled in the art. Throughout the detailed description, similar numbers indicate similar elements.

[0036] According to embodiments set forth in this specification, a method for detecting a volumetric DoS attack initiated by a compromised UE (e.g., an IoT device or any other type of UE) connected to a wireless access network (RAN) is provided. The detection is performed by a wireless network node providing the RAN. This detection is achieved by analyzing metrics derived from RAN signaling associated with the UE in question. The contents of the packets are not evaluated; and the DoS detection operates without requiring deep packet inspection. This detection enables the DoS attack to be mitigated by the wireless network node, as described in more detail below.

[0037] FIG. 1 is a schematic diagram illustrating an environment in which an embodiment of the present specification may be applied. A cellular communication network (8) includes a core network (3) and one or more wireless network nodes (1) (also known as base stations) that provide a RAN for one or more UEs (2).

[0038] The wireless network node (1) may be in the form of a wireless base station, such as a gNode B, gNB, or an evolved Node B, also known as an eNode B or eNB. The wireless network node may also be in the form of a Node B, a Base Transceiver Station (BTS), and / or a Base Station Subsystem (BSS). The wireless network node (1) provides wireless connectivity to one or more UEs (2) using a RAN through wireless interfaces (4a-b). The wireless network node (1) may be implemented in the form of a single hardware device, as illustrated in FIG. 2 and described below, or distributed across several devices.

[0039] Through the wireless interface of the RAN, downlink (DL) communication (4a) from the wireless network node (1) to the UE (2) and uplink (UL) communication (4b) from the UE (2) to the wireless network node (1) occur. The quality of the wireless interface for each UE (2) may change over time and depending on the location of the UE (2) due to effects such as fading, multipath propagation, and interference.

[0040] The term UE is also known as a mobile communication terminal, user device, mobile terminal, user terminal, user agent, wireless device, wireless terminal, machine-machine device, etc., and can be implemented, for example, by what is generally known today as a mobile phone, smartphone, IoT device, or tablet / laptop with wireless connectivity.

[0041] A cellular communication network (8) may comply with, for example, 5G NR (fifth generation new radio), LTE (Long Term Evolution), LTE-Advanced, 6G (sixth generation), W-CDMA (Wideband Code Division Multiplex), or any other current or future wireless network or a combination thereof, as long as the principles described in this specification are applicable.

[0042] A wireless network node (1) is connected to a core network (3) for network central functions and a connection to a wide area network (9) such as the Internet. A server (5) is also connected to the network. Both user plane data and control plane data are transmitted through the UL and DL links (4a / 4b) of the RAN.

[0043] It is possible for an attacker to gain control of a UE (2) to organize a targeted Denial of Service (DoS) attack against a node within a core network (3) and / or a server (5), for example. When multiple devices, such as UEs (2), are used in the same attack, this is called a distributed DoS (DDoS) attack. Each UE (2) may form part of a DDoS attack in this manner, but this is referred to as a DoS attack.

[0044] When a UE (2) is compromised for the purpose of DoS, such UE is referred to herein as a DoS UE. One form of DoS attack is a UDP burst, in which an attacker controls the DoS UE (2) to send a large volume of UDP packets to a target device. Another type of DoS attack is a TCP SYN burst attack. Since the TCP SYN message is the initial message for establishing a TCP connection, and can be sent to a server before the TCP connection is established while still complying with the TCP protocol, this attack operates on the same principle as a UDP burst. This can be attractive from an attacker's perspective because both UDP packets and TCP SYN packets can be transmitted from the compromised UE, and these packets can be optionally repeated randomly in terms of time and frequency. Both UDP burst attacks and TCP SYN burst attacks are referred to as volumetric attacks.

[0045] According to an embodiment set forth in this specification, a wireless network node (1) detects a DoS attack against an upstream node (e.g., a node of the core network (3) or server (5)), wherein the DoS attack is based (at least partially) on traffic from the UE (2). The upstream node should be interpreted as a node located more centrally from the wireless network node (1), that is, in a topology direction different from that of the UE and / or in the same topology direction as the core network or wide area network (9) when viewed from the wireless network node (1).

[0046] FIG. 2 is a schematic diagram illustrating an example of a distributed implementation of a wireless network node (1). The wireless network node (1) consists of a baseband node (6) and a wireless node (7).

[0047] A wireless network node (1) includes a baseband node (10), which is a baseband processing unit, and one or more remote wireless nodes (11). When applied to an Open RAN (O-RAN) architecture, the baseband node may be an O-DU (O-RAN distributed unit) node, and the wireless node may be an O-RU (O-RAN radio unit) node. In 5G terminology, for example, according to a Centralized / Cloud Radio Access Network (C-RAN) architecture, the baseband node (10) may be a gNB-CU, and the wireless node (11) may be a gNB-DU.

[0048] The baseband node (10) and the wireless node (11) may be located at different locations. The baseband node (10) is located upstream from the wireless node (11), that is, toward the core network (3). Consequently, the wireless node (11) may be located downstream from the baseband node (10) toward the UE (2). One or more fronthaul links (18) exist between the baseband node (10) and the wireless node (11). The fronthaul link (18) is a bidirectional communication link. The fronthaul link (18) may be implemented using Common Public Radio Interface (CPRI) or eCPRI (evolved CPRI) and Ethernet. Multiple fronthaul links may be used in a topology different from that shown in FIG. 1. Multiple fronthaul links may also be represented as a fronthaul network. Each of the baseband node (10) and the wireless node (11) can implement a subset of the functions of the RAN for wireless communication with the UE (2). Additionally, some functions for wireless communication can be virtualized, which is also known as a cloud RAN.

[0049] FIG. 3 illustrates a protocol stack (20) comprising a set of protocols (21, 22, 23, 24) for RAN communication between the UE (2) of FIG. 1 and a wireless network node (1). Here, a protocol stack (20) for transmitting IP packets (10) over the RAN is illustrated. The protocol stack consists of SDAP (service data adaptation protocol) (21), PDCP (packet data convergence protocol) (22), and RLC (radio link control) (23). At the lowest level, a MAC (media access control) protocol (24) is present.

[0050] Each protocol (21-24) takes a service data unit (SDU) (10, 11, 12, 13) from an upper protocol layer to form a payload (11a, 12a, 13a, 14a). Then, the protocol (21-24) adds protocol-specific control data, such as a header (11b, 12b, 13b, 14b), to create individual protocol data units (PDU) (11, 12, 13, 14). The PDU is provided to the next lower layer of the protocol stack (20) to form an SDU for that layer.

[0051] The MAC layer (24) can combine multiple SDUs from the RLC layer (23) into a single PDU (14) (including individual payloads (14a, 14a') and headers (14b, 14b'). In other words, a MAC PDU transmission block is formed by one or several MAC PDUs. For SDAP and PDCP, there is a one-to-one relationship between the PDUs (11, 12) and the IP packets (10).

[0052] FIGS. 4a and 4b are flowcharts illustrating an embodiment of a method for detecting a DoS attack on an upstream device, such as a core network (3) or a server (5) of FIG. 1. The method is performed at a wireless network node (1). First, an embodiment illustrated in FIG. 4a will be described.

[0053] metrics acquisition In step (40), the wireless network node (1) obtains (at least one) metric based on RAN signaling for communication between the UE and the wireless network node (1). The RAN signaling includes one or more protocol procedures, and its structure and use are, for example, but not limited to, a 3rd generation partnership project (3 rdIt may be defined in relevant standard specifications by the Generation Partnership Project or the Internet Engineering Task Force.

[0054] The metric may be based on the volume of scheduling requests transmitted from the UE. Alternatively or additionally, the metric is based on buffer status reports (BSRs) from the UE. Alternatively or additionally, the metric is based on the volume of used PRBs.

[0055] conditional DoS attack In step (42), the wireless network node (1) determines whether a DoS attack is proceeding toward an upstream device (3) based on a metric. The upstream device is located outside the wireless network node (1) and is provided upstream from the wireless network node (1).

[0056] When the metric includes an indication of the volume of scheduling requests, a DoS attack can be determined based on the fact that the volume of scheduling requests is smaller than the threshold volume of scheduling requests. The volume of scheduling requests can be defined, for example, as the number of scheduling requests per unit of time.

[0057] A scheduling request is a request from a UE to a wireless network node (1) to transmit UL traffic. When the wireless network node (1) accepts the request, it schedules UL traffic for the UE and sends an acknowledgment message indicating where the UL traffic is scheduled for transmission to the UE. If the time interval between packets is short, there is no need to send a new scheduling request to the network.

[0058] Therefore, when a volumetric DoS attack is in progress and the buffer of the DoS UE is filled with data for UL transmission, leading to a high rate of UL packets being transmitted, the volume of scheduling requests is significantly lower than in normal traffic.

[0059] BSR is part of the MAC layer procedure used by the UE to provide information regarding the amount of data available for transmission in the UL buffer. The BSR is transmitted to a serving wireless network node (1). When the metric is based on the BSR from the UE, a DoS attack can be determined based on statistics of the frequency of the BSR indicating a frequency greater than the threshold frequency. The frequency can be defined as the number of BSRs per unit time, or using an equivalent such as the average time between BSR transmissions.

[0060] When volumetric DoS attacks on the user plane are present, BSR is more frequent due to the continuous transmission of UL attack traffic compared to benign scenarios with lower rate traffic.

[0061] Alternatively, or additionally, a DoS attack can be determined based on the BSR, which indicates a high buffer level over time. Due to the short intervals between PDUs during the attack and the possible concatenation of PDCP PDUs (in the case of LTE), the buffer level will remain high during a volumetric DoS attack.

[0062] When the metric is based on the volume of the PRB, a DoS attack can be determined based on whether the volume of the PRB is greater than the threshold volume of the PRB.

[0063] A wireless network node (1) can be configured to detect any volumetric DoS attack, such as a burst of UDP packets and / or a burst of TCP SYN messages. Thus, the detected DoS attack may involve a user plane attack.

[0064] When a DoS attack is not determined, the method returns to the metric acquisition step (40). When a DoS attack is determined, this can be used internally or externally, and then the method terminates or metrics acquisition You can return to step (40).

[0065] Now, referring to Fig. 4b, only new or modified steps compared to Fig. 4a will be described.

[0066] Optional Attack signaling In step (44), the wireless network node (1) signals an alert indicating that a DoS attack is in progress.

[0067] Such signaling may occur locally within a wireless network node (1). In this case, the wireless network node (1) may act as a policy enforcement point (PEP) by, for example, denying (or restricting) wireless resources to a DoS UE. Thus, the DoS UE has no wireless access, which prevents the DoS UE from transmitting any (or excessive) amount of traffic. This provides a rapid response to the detected attack. Since the embodiment presented herein is implemented in a wireless network node (1), this node governs the scheduling and enables the response and mitigation of the attack to occur quickly and with substantial effect.

[0068] Alternatively or additionally, signaling of a DoS attack occurs from a wireless network node (1) to a core network (3). In this case, the wireless network node (1) acts as a policy decision point (PDP), while a network node within the core network acts as a policy decision point (PEP). For example, the access and mobility management function (AMF) of the core network can act as a PEP. In this way, the AMF can use the alerts, attack information, and DoS UE information provided by the wireless network node (1) to take action against and respond to the DoS UE, for example, by deregistering or isolating the DoS UE from the network.

[0069] Metrics may be based on control plane traffic, that is, not RAN user plane traffic, even though control plane traffic often supports user plane traffic. Control plane traffic may occur, for example, through a Uu interface provided to a UE by a wireless network node (1). The embodiments set forth herein do not rely on the inspection of packet contents.

[0070] The results of a simulation to illustrate how a DoS can be detected will now be explained. The simulated DoS is a UDP overload attack, but the same principles can be applied to TCP SYN overload or other volumetric DoS attacks. In the simulation, the UE is a Raspberry Pi acting as the DoS UE in the form of an IoT controller that communicates normally with a robot arm.

[0071] UEs have specific traffic patterns for benign traffic. This benign traffic has the following characteristics:

[0072] TCP protocol traffic transmitting packets to the robot arm.

[0073] · 160-320 byte packets are transmitted every 10ms.

[0074] · Several packets of 1514 bytes in size are transmitted every 200-500ms.

[0075] Additionally, the UE is simulated to send a UDP flood attack during a specific time period in a mixed traffic scenario. Thus, malicious traffic is mixed with benign traffic over time. The simulation is configured to run for 30 seconds, with the attack period running for 10 seconds in the middle of the 30 seconds to target the / 24 subnet. The results are compared to running only on benign traffic.

[0076] The benign traffic in the mixed traffic scenario is of the same type as the benign traffic described above. The malicious traffic targeted the / 24 subnet, where several targets responding to the service of interest existed. The UDP payload was set to a size of 512 bytes.

[0077] During the attack period, the number of SRs decreases significantly (about 62%). Additionally, the number of PRBs increases significantly during the attack period to support increased UL traffic requiring increased user plane traffic, and therefore a larger number of PRBs per unit time.

[0078] The embodiments set forth in this specification do not examine or analyze any IP packets carried in the wireless protocol. Instead, metrics derived from the RAN control plane are examined and analyzed. This allows for the detection of DoS attacks even when IP packets are hidden or obscured from the wireless network node (1), for example, through encryption.

[0079] Because the DoS attack is detected by a wireless network node (1) that is topologically close to the compromised UE, the DoS attack can be detected faster and resolved more effectively. Additionally, the wireless network node (1) can utilize metrics such as SR volume, BSR and PRB usage that are not available in a pure IP context.

[0080] Detection by the wireless network node (1) also enables the wireless network node (1) to apply local response and mitigation actions. For example, the wireless network node (1) can deny wireless resources to the DoS UE, which, in addition to mitigating attacks on upstream target devices, reduces the impact on the RAN by the DoS UE. Furthermore, the communication infrastructure can also be protected, for example, by reducing or eliminating DoS traffic, which otherwise consumes bandwidth of the backhaul network for the core network. Additionally, the embodiments presented herein address scalability issues in the network, thereby reducing the need for additional DoS detection solutions.

[0081] FIG. 5 is a schematic diagram illustrating the components of the wireless network node (1) of FIG. 1. The processor (60) is provided using any combination of one or more of a suitable central processing unit (CPU), graphics processing unit (GPU), multiprocessor, neural processing unit (NPU), microcontroller, digital signal processor (DSP), etc., capable of executing software instructions (67) stored in memory (64), which may thus be a computer program product. Alternatively, the processor (60) may be implemented using an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), etc. The processor (60) may be configured to execute the method described with reference to FIG. 4a and FIG. 4b above.

[0082] The memory (64) may be any combination of random access memory (RAM) and / or read-only memory (ROM). The memory (64) also includes a non-transient permanent storage that may be, for example, any one of magnetic memory, optical memory, solid-state memory, or even remotely mounted memory or a combination thereof.

[0083] A data memory (66) is also provided to read and / or store data during the execution of software instructions in the processor (60). The data memory (66) may be any combination of RAM and / or ROM.

[0084] The wireless network node (1) further includes an I / O interface (62) for communicating with external and / or internal entities. Optionally, the I / O interface (62) also includes a user interface.

[0085] The transceiver (61) includes analog and digital components suitable for allowing signal transmission and reception with the UE using one or more antennas (63).

[0086] Other components of the wireless network node (1) are omitted so as not to obscure the concepts presented in this specification.

[0087] FIG. 6 is a schematic diagram illustrating a functional module of a wireless network node (1) of FIG. 1 according to one embodiment. The module is implemented using software instructions, such as a computer program running on the wireless network node (1). Alternatively or additionally, the module is implemented using hardware such as any one or more of an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or a discrete logical circuit. The module corresponds to a step in the method illustrated in FIG. 4a and FIG. 4b.

[0088] The metric acquirer (70) corresponds to step (40). The DoS attack determiner (72) corresponds to step (42). The attack signaler (74) corresponds to step (44).

[0089] FIG. 7 illustrates an example of a computer program product (90) comprising computer-readable means. On such computer-readable means, a computer program (91) may be stored in non-transient memory. The computer program may cause a processor to execute a method according to an embodiment described herein. In this example, the computer program product is in the form of removable solid-state memory, for example, a Universal Serial Bus (USB) drive. As described above, the computer program product may also be implemented as memory of a device, such as the computer program product (64) of FIG. 5. Here, the computer program (91) is schematically illustrated as a section of removable solid-state memory, but the computer program may be stored in any manner suitable for other types of removable solid-state memory or computer program products such as optical discs (e.g., CD (compact disc), DVD (digital versatile disc) or Blu-ray disc).

[0090] Aspects of the present disclosure have been described above with reference to a few embodiments. However, as will be readily understood by those skilled in the art, and as defined by the appended claims, embodiments other than those disclosed above are equally possible within the scope of the invention. Accordingly, although various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for illustrative purposes only and are not intended to be limiting, and the actual scope and concept are indicated by the following claims.

Claims

Claim 1 A method for detecting a denial-of-service (DoS) attack on an upstream device (3, 5), wherein the method is performed at a wireless network node (1), and the method comprises: a step (40) of obtaining a metric based on radio access network (RAN) signaling for communication between user equipment (UE) (2) and the wireless network node (1) - said metric is based on at least one of a buffer status report (BSR) from the UE and a volume of a physical resource block (PRB) used -; and a step (42) of determining that a DoS attack is in progress on the upstream device (3, 5) based on said metric - said upstream device (3, 5) is provided upstream from the wireless network node (1), and where said metric is based on said BSR, the step (42) of determining that a DoS attack is in progress includes determining that the frequency statistics of the BSR indicate a frequency greater than a threshold frequency - Claim 2 A method according to claim 1, wherein the metric is based on the volume of scheduling requests transmitted from the UE. Claim 3 In paragraph 2, the step (42) of determining that the above DoS attack is in progress includes the step of determining that the volume of the scheduling request is smaller than the threshold volume of the scheduling request. Claim 4 A method according to any one of claims 1 to 3, wherein the step (42) of determining that the DoS attack is in progress includes the step of determining that the BSR indicates a high buffer level over time. Claim 5 A method according to any one of claims 1 to 3, wherein the step (42) of determining that the DoS attack is in progress includes the step of determining that the volume of the PRB is greater than the threshold volume of the PRB. Claim 6 A method comprising, in any one of claims 1 to 3, a step (44) of signaling an alarm indicating that the DoS attack is in progress. Claim 7 A method according to any one of claims 1 to 3, wherein the step (42) of determining that the DoS attack is in progress is configured to detect a flood of user datagram protocol (UDP) packets. Claim 8 A method according to any one of claims 1 to 3, wherein the step (42) of determining that the DoS attack is in progress is configured to detect a surge of transport control protocol (TCP) synchronization (SYN) messages. Claim 9 A method according to any one of claims 1 to 3, wherein the DoS attack involves a user plane attack. Claim 10 As a wireless network node (1) for detecting a denial-of-service (DoS) attack against upstream devices (3, 5), the wireless network node (1) comprises: a processor (60); and a memory (64) for storing a command (67), wherein the command (67), when executed by the processor, causes the wireless network node (1) to: obtain a metric based on radio access network (RAN) signaling for communication between user equipment (UE) (2) and the wireless network node (1) - said metric is based on at least one of a buffer status report (BSR) from the UE and the volume of a physical resource block (PRB) used - ; and determining that a DoS attack is proceeding on the upstream device (3, 5) based on the above metric, wherein the upstream device (3, 5) is provided upstream from the wireless network node (1), and when the above metric is based on the BSR, the command for determining that the DoS attack is proceeding includes a command (67) which, when executed by the processor, causes the wireless network node (1) to determine that the frequency statistics of the BSR indicate a frequency greater than a threshold frequency. Claim 11 In paragraph 10, the above metric is based on the volume of scheduling requests transmitted from the UE, a wireless network node (1). Claim 12 In claim 11, the command for determining that the above DoS attack is in progress includes a command (67) that causes the wireless network node (1) to determine that the volume of the scheduling request is smaller than the threshold volume of the scheduling request when executed by the processor. Claim 13 In any one of claims 10 to 12, the command for determining that the DoS attack is in progress includes a command (67) that causes the wireless network node (1) to determine that the BSR indicates a high buffer level over time when executed by the processor. Claim 14 In any one of claims 10 to 12, the command for determining that the DoS attack is in progress includes a command (67) that causes the wireless network node (1) to determine that the volume of the PRB is greater than the threshold volume of the PRB when executed by the processor. Claim 15 A wireless network node (1) further comprising, in any one of claims 10 to 12, a command (67) that causes the wireless network node (1) to signal an alarm indicating that the DoS attack is in progress when executed by the processor. Claim 16 In any one of claims 10 to 12, the command for determining that the above DoS attack is in progress includes a command (67) that causes the wireless network node (1) to detect a flood of user datagram protocol (UDP) packets when executed by the processor, a wireless network node (1). Claim 17 In any one of claims 10 to 12, the command for determining that the DoS attack is in progress includes a command (67) that causes the wireless network node (1) to detect a flood of transport control protocol (TCP) synchronization (SYN) messages when executed by the processor, the wireless network node (1). Claim 18 In any one of clauses 10 to 12, the wireless network node (1) in which the DoS attack involves a user plane attack. Claim 19 A computer program (67, 91) stored on a computer-readable storage medium for detecting a denial-of-service (DoS) attack against an upstream device (3, 5), wherein the computer program includes computer program code, and when the computer program code is executed on a wireless network node (1), the wireless network node (1) obtains a metric based on radio access network (RAN) signaling for communication between user equipment (UE) (2) and the wireless network node (1) - said metric is based on at least one of a buffer status report (BSR) from the UE and the volume of a physical resource block (PRB) used - ; A computer program (67, 91) for determining that a DoS attack is in progress on the upstream device (3, 5) based on the above metric, wherein the upstream device (3, 5) is provided upstream from the wireless network node (1), and when the metric is based on the BSR, the computer program code for determining that the DoS attack is in progress includes computer program code that, when executed on the wireless network node (1), causes the wireless network node (1) to determine that the frequency statistics of the BSR indicate a frequency greater than a threshold frequency. Claim 20 A non-transient computer-readable storage medium storing a computer program according to paragraph 19. Claim 21 delete Claim 22 delete Claim 23 delete Claim 24 delete Claim 25 delete Claim 26 delete

Images