Skip to main content

Lund University Publications

LUND UNIVERSITY LIBRARIES

Learning at the edge : simulated DDoS detection in 5G networks

Khalil, Karim LU ; Breum Hansen, Lars ; Tayebi, Elham and Gehrmann, Christian LU (2025) In Proceedings of the XXth Conference of Open Innovations Association FRUCT
Abstract
The growing use of 5G networks for critical services makes them vulnerable to Distributed Denial of Service (DDoS) attacks. While numerous Machine Learning (ML)-based approaches have been proposed, the real-world deployability of these models remains understudied. This work presents what is, based on existing literature, the first simulation-driven methodology to evaluate both the transferability and the operational feasibility of ML-driven DDoS detection in realistic 5G Multi-Access Edge Computing (MEC) settings. The study assess the cross-scenario performance of two state-of-the-art Convolutional Neural Network (CNN) DDoS detection models using three diverse datasets, including synthetic traffic representative of 5G environments.... (More)
The growing use of 5G networks for critical services makes them vulnerable to Distributed Denial of Service (DDoS) attacks. While numerous Machine Learning (ML)-based approaches have been proposed, the real-world deployability of these models remains understudied. This work presents what is, based on existing literature, the first simulation-driven methodology to evaluate both the transferability and the operational feasibility of ML-driven DDoS detection in realistic 5G Multi-Access Edge Computing (MEC) settings. The study assess the cross-scenario performance of two state-of-the-art Convolutional Neural Network (CNN) DDoS detection models using three diverse datasets, including synthetic traffic representative of 5G environments. Leveraging the full 5G network simulator Simu5G, the study integrate the better-performing model into an MEC application to demonstrate a functional end-to-end pipeline from offline training to live attack mitigation. This approach delivers a reproducible framework for testing ML-based network defenses under realistic yet controllable conditions, enabling systematic evaluation beyond static benchmarks. The results confirm the feasibility of assessing the practical resilience of ML-driven DDoS defenses in 5G networks, with several areas identified for further optimization, including expansion of attack scenarios, enhancement of model robustness across datasets, and refinement of deployment strategies within the simulation environment. (Less)
Please use this url to cite or link to this publication:
author
; ; and
organization
publishing date
type
Chapter in Book/Report/Conference proceeding
publication status
published
subject
host publication
Proceedings of the 38th Conference of Open Innovations Association FRUCT : 5-7 November 2025, Helsinki, Finland (hybrid) - 5-7 November 2025, Helsinki, Finland (hybrid)
series title
Proceedings of the XXth Conference of Open Innovations Association FRUCT
edition
38th
pages
8 pages
publisher
IEEE - Institute of Electrical and Electronics Engineers Inc.
ISSN
2305-7254
2343-0737
ISBN
978-952-65246-4-1
DOI
10.23919/FRUCT67853.2025.11239169
language
English
LU publication?
yes
id
1635d2ff-cc1f-4156-bc4b-cd01a3423574
date added to LUP
2025-12-03 14:33:45
date last changed
2025-12-11 11:24:15
@inproceedings{1635d2ff-cc1f-4156-bc4b-cd01a3423574,
  abstract     = {{The growing use of 5G networks for critical services makes them vulnerable to Distributed Denial of Service (DDoS) attacks. While numerous Machine Learning (ML)-based approaches have been proposed, the real-world deployability of these models remains understudied. This work presents what is, based on existing literature, the first simulation-driven methodology to evaluate both the transferability and the operational feasibility of ML-driven DDoS detection in realistic 5G Multi-Access Edge Computing (MEC) settings. The study assess the cross-scenario performance of two state-of-the-art Convolutional Neural Network (CNN) DDoS detection models using three diverse datasets, including synthetic traffic representative of 5G environments. Leveraging the full 5G network simulator Simu5G, the study integrate the better-performing model into an MEC application to demonstrate a functional end-to-end pipeline from offline training to live attack mitigation. This approach delivers a reproducible framework for testing ML-based network defenses under realistic yet controllable conditions, enabling systematic evaluation beyond static benchmarks. The results confirm the feasibility of assessing the practical resilience of ML-driven DDoS defenses in 5G networks, with several areas identified for further optimization, including expansion of attack scenarios, enhancement of model robustness across datasets, and refinement of deployment strategies within the simulation environment.}},
  author       = {{Khalil, Karim and Breum Hansen, Lars and Tayebi, Elham and Gehrmann, Christian}},
  booktitle    = {{Proceedings of the 38th Conference of Open Innovations Association FRUCT : 5-7 November 2025, Helsinki, Finland (hybrid)}},
  isbn         = {{978-952-65246-4-1}},
  issn         = {{2305-7254}},
  language     = {{eng}},
  month        = {{11}},
  publisher    = {{IEEE - Institute of Electrical and Electronics Engineers Inc.}},
  series       = {{Proceedings of the XXth Conference of Open Innovations Association FRUCT}},
  title        = {{Learning at the edge : simulated DDoS detection in 5G networks}},
  url          = {{http://dx.doi.org/10.23919/FRUCT67853.2025.11239169}},
  doi          = {{10.23919/FRUCT67853.2025.11239169}},
  year         = {{2025}},
}