AI/ML DDoS Prevention in 5G CBRS Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
5G cellular communication networks, particularly those using CBRS technology, face challenges in preventing Distributed Denial of Service (DDoS) attacks from both external and internal sources, as existing security measures are inadequate in detecting and mitigating legitimate user floods and internal threats, which can compromise mission-critical systems.
Innovation Solution
Implementing an AI/ML model as a virtualized network function (VNF) in the data plane to learn normal network behavior and identify exceptions, allowing for real-time threat mitigation by ignoring malicious calls from trusted devices within the network, utilizing OpenNESS edge-device management and Kubernetes-based architecture for effective DDoS prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If rule-based WWW DDOS protection techniques are used, then external DDOS attacks can be mitigated, but internal attacks from legitimate users cannot be detected
Solution Approach 1:
The patent changes the fundamental parameter of attack detection from static rule-based matching to dynamic behavioral analysis. The system learns normal traffic patterns during a training period and detects deviations from these patterns, enabling identification of internal attacks while maintaining protection against external threats. This parameter change allows the system to adapt to both external and internal attack vectors.
Solution Approach 2:
The system implements self-service by automatically learning normal network behavior patterns during a training period without manual intervention. The machine learning model autonomously identifies baseline traffic characteristics and uses this knowledge to detect anomalies, eliminating the need for continuous manual rule updates and enabling automatic detection of both external and internal attacks.
2Reliability
If conventional SDS-based security approaches are used, then user authentication is provided, but flood attacks from legitimate users cannot be prevented
Solution Approach 1:
The patent merges authentication security with behavioral analysis security. The system combines conventional SDS-based authentication mechanisms with machine learning-based traffic pattern analysis. This integration allows the system to verify user identity through authentication while simultaneously monitoring traffic patterns to detect and prevent flood attacks from legitimate authenticated users.
Solution Approach 2:
The system implements feedback by continuously monitoring network traffic patterns and using this information to dynamically adjust security responses. The machine learning model receives feedback from ongoing traffic analysis and uses this information to identify flood attacks in real-time, enabling the system to respond to threats while maintaining authenticated user connectivity.
3Object-affected harmful factors
If anti-electronic warfare techniques are used, then radio access network protection is improved, but latency in critical systems increases
Solution Approach 1:
The patent applies preliminary action by conducting behavioral analysis and threat detection proactively during a training period before actual attacks occur. The system learns normal traffic patterns in advance and establishes baseline behavior, enabling real-time detection and response to attacks without adding latency to critical operations. This preliminary learning phase eliminates the need for time-consuming analysis during active attacks.
Data Source
AI summary
One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.