A Slice Escape Detection Model Based on Full Flow Adaptive Detection

• Published in: Tehnički vjesnik Vol. 31; no. 4; pp. 1232 - 1244
• Main Authors: Liu, Zhenzhen, Zhou, Rui, Chen, Jingbing, Huang, Kangqian, Huang, Jingyin, Cai, Binsi, Gao, Yali, Yuan, Kaiguo
• Format: Journal Article Paper
• Language: English
• Published: Slavonski Baod University of Osijek 01.08.2024; Josipa Jurja Strossmayer University of Osijek; Sveučilište u Slavonskom Brodu, Stojarski fakultet; Faculty of Mechanical Engineering in Slavonski Brod, Faculty of Electrical Engineering in Osijek, Faculty of Civil Engineering in Osijek
• Subjects: Analysis; Damage detection; Energy trading; Exception handling; False alarms; Forecasts and trends; long short-term memory; network slicing; Private networks; slice escape; China
• ISSN: 1330-3651; 1848-6339
• DOI: 10.17559/TV-20230708000792

The 5G power trading private network increases network flexibility and lowers building costs with the aid of 5G and Access Point Name (APN) technology. However, the private network is facing a series of security problems, such as the lack of effective isolation between slices and malicious terminal damage in slices, which result in a large consumption of slice resource failures and even slice escape attacks. To solve this problem, we propose a slice escape detection model based on full flow adaptive detection. Firstly, we improve the "six-tuple" flow table features detection technology, and creatively proposed a set of "eleven-tuple" features scheme, so as to realize the adaptive detection of intra-slice and inter-slice escape attacks. Secondly, we construct a two-level detection model based on long short-term memory network and self-attention mechanism to improve detection efficiency and reduce false alarm rate. Thirdly, we design an exception handling module to handle the abnormally detected traffic. Our model has a high detection accuracy and a low false alarm rate for the slice escape assault, according to a large number of experiments on the CIC-DDoS2019 dataset, and the detection delay complies with the requirements for online detection.