NWDAF Analytics for Abnormal Network Function Service Usage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
5G communication networks face challenges in detecting abnormal network function service usage, which can lead to privacy attacks and distributed attacks aimed at inferring AI/ML model functionalities and sensitive information.
Innovation Solution
The implementation of 'expected service usage' and 'abnormal service usage' analytics services within the Network Data Analytics Function (NWDAF) monitors the distribution of incoming requests to detect potential privacy attacks and distributed attacks, even when request frequencies are normal.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network function services are deployed to improve network efficiency and subscriber convenience, then network service capability is enhanced, but security management issues arise that compromise network reliability
Solution Approach 1:
The system performs preliminary analysis of service requests to establish expected usage patterns before attacks occur. The NWDAF collects and analyzes service request data from multiple NFs to create baseline profiles of normal service usage, enabling proactive detection of deviations that indicate potential attacks
Solution Approach 2:
The system implements continuous feedback loops where the NWDAF monitors service requests, compares them against expected usage patterns, and provides real-time alerts when abnormal usage is detected. This feedback mechanism enables dynamic adjustment of security measures while maintaining normal service operations
2Ease of operation
If traditional security monitoring methods are used, then implementation is simple, but they fail to detect distributed attacks with normal request frequencies
Solution Approach 1:
The system segments the analysis of service requests by NF type, service type, and request characteristics. Instead of treating all requests uniformly, it divides them into categories and analyzes patterns within each segment, enabling detection of subtle distributed attacks that would be invisible in aggregate statistics
Solution Approach 2:
The NWDAF is designed as a universal analytics function that can analyze service requests across multiple NFs and service types using the same analytical framework. This multi-functional approach maintains ease of operation while achieving high detection precision through standardized pattern recognition
3Measurement precision
If detailed analysis of all service requests is performed to detect attacks, then detection precision is improved, but network entity processing load increases
Solution Approach 1:
The system performs partial analysis by focusing only on the most critical aspects of service requests relevant to attack detection. Rather than analyzing every detail of each request, it selectively examines specific parameters and patterns that indicate potential threats, reducing processing load while maintaining detection precision
Solution Approach 2:
The NWDAF acts as an intermediary that receives service request data from multiple NFs, performs centralized analysis, and returns results. This mediator approach allows NFs to maintain their primary functions while offloading the computationally intensive analysis task to a specialized analytics function
Data Source
AI summary
Techniques for detection of abnormal network function service usage in a communication network are disclosed. For example, a method comprises obtaining, at a first network entity, one or more service requests previously received by a second network entity for a service which the second network entity is configured to provide in a communication network. The method further comprises obtaining, at the first network entity, an analysis of the one or more service requests previously received by the second network entity for the service. The method further comprises obtaining, at the first network entity, an expected service usage for the service from the analysis of the one or more service requests. The method may then compare incoming service requests to the expected service usage to detect a given condition, e.g., an abnormal condition, so that at least one action can be taken.