PUL-Inter-slice Defender: An Anomaly Detection Solution for Distributed Slice Mobility Attacks

• URL: http://arxiv.org/abs/2510.02236v1
• Date: Thu, 02 Oct 2025 17:24:17 GMT
• Title: PUL-Inter-slice Defender: An Anomaly Detection Solution for Distributed Slice Mobility Attacks
• Abstract summary: A vulnerability in Inter-Slice Switching (ISS) can be exploited to launch Distributed Slice Mobility (DSM) attacks.<n>We present PUL-Inter-Slice Defender, an anomaly detection solution that leverages Positive Unlabeled Learning (PUL) and incorporates a combination of Long Short-Term Memory Autoencoders and K-Means clustering.
• Score: 11.124385969043644
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: Network Slices (NSs) are virtual networks operating over a shared physical infrastructure, each designed to meet specific application requirements while maintaining consistent Quality of Service (QoS). In Fifth Generation (5G) networks, User Equipment (UE) can connect to and seamlessly switch between multiple NSs to access diverse services. However, this flexibility, known as Inter-Slice Switching (ISS), introduces a potential vulnerability that can be exploited to launch Distributed Slice Mobility (DSM) attacks, a form of Distributed Denial of Service (DDoS) attack. To secure 5G networks and their NSs against DSM attacks, we present in this work, PUL-Inter-Slice Defender; an anomaly detection solution that leverages Positive Unlabeled Learning (PUL) and incorporates a combination of Long Short-Term Memory Autoencoders and K-Means clustering. PUL-Inter-Slice Defender leverages the Third Generation Partnership Project (3GPP) key performance indicators and performance measurement counters as features for its machine learning models to detect DSM attack variants while maintaining robustness in the presence of contaminated training data. When evaluated on data collected from our 5G testbed based on the open-source free5GC and UERANSIM, a UE/ Radio Access Network (RAN) simulator; PUL-Inter-Slice Defender achieved F1-scores exceeding 98.50% on training datasets with 10% to 40% attack contamination, consistently outperforming its counterpart Inter-Slice Defender and other PUL based solutions combining One-Class Support Vector Machine (OCSVM) with Random Forest and XGBoost.

Related papers

• Modality-Decoupled Federated Learning for Privacy-Preserving Embodied Intelligence in 6G [90.42669277637026]
  Sixth-generation (6G) wireless networks are expected to provide a key infrastructure for large-scale embodied intelligence.<n>This article proposes FedMVLA, a modality-decoupled FL framework for privacy-preserving embodied intelligence in 6G networks.
  arXiv  Detail & Related papers  (2026-09-09T01:36:44Z)
• Toward Resilient 5G Networks: Comparative Analysis of Federated and Centralized Learning for RF Jamming Detection [6.554690373570662]
  Jamming attacks target 5G radio frequency (RF) domain and can disrupt the communication in wireless networks.<n>This work proposes a federated learning (FL)-based detection framework that operates on over-the-air In-phase and Quadrature (IQ) samples.<n>We adopt Federated Averaging (FedAvg) algorithm to train a 1D convolutional neural network (1DCNN) for effective detection of attacks.
  arXiv  Detail & Related papers  (2026-05-03T04:13:27Z)
• Slice-Aware Spoofing Detection in 5G Networks Using Lightweight Machine Learning [0.0]
  This study presents a slice-aware lightweight machine-learning framework for detecting spoofing attacks within 5G network slices.<n>The framework was implemented on a reproducible Open5GS and srsRAN testbed.<n>Results show that aligning security intelligence with slice boundaries enhances detection reliability and preserves operational isolation.
  arXiv  Detail & Related papers  (2025-11-12T18:44:02Z)
• Integrity Under Siege: A Rogue gNodeB's Manipulation of 5G Network Slice Allocation [2.90110037823427]
  5G networks, with network slicing as a cornerstone technology, promises customized, high-performance services, but also introduces novel attack surfaces beyond traditional threats.<n>This article investigates a critical and underexplored integrity vulnerability: the manipulation of network slice allocation to compromise Quality of Service (QoS) and resource integrity.<n>We show how a rogue gNodeB acting as a Man-in-the-Middle can exploit protocol weaknesses to forge slice requests and hijack a User Equipment's connection.
  arXiv  Detail & Related papers  (2025-11-05T09:26:39Z)
• Hybrid Deep Learning-Federated Learning Powered Intrusion Detection System for IoT/5G Advanced Edge Computing Network [0.0]
  IoT and 5G-Advanced applications have enlarged the attack surface for DDoS, malware, and zero-day intrusions.<n>We propose an intrusion detection system that fuses a convolutional neural network (CNN), a bidirectional LSTM (BiLSTM), and an autoencoder (AE) bottleneck.
  arXiv  Detail & Related papers  (2025-09-19T03:23:51Z)
• ZORRO: Zero-Knowledge Robustness and Privacy for Split Learning (Full Version) [58.595691399741646]
  Split Learning (SL) is a distributed learning approach that enables resource-constrained clients to collaboratively train deep neural networks (DNNs)<n>This setup enables SL to leverage server capacities without sharing data, making it highly effective in resource-constrained environments dealing with sensitive data.<n>We present ZORRO, a private, verifiable, and robust SL defense scheme.
  arXiv  Detail & Related papers  (2025-09-11T18:44:09Z)
• Pigeon-SL: Robust Split Learning Framework for Edge Intelligence under Malicious Clients [53.496957000114875]
  We introduce Pigeon-SL, a novel scheme that guarantees at least one entirely honest cluster among M clients, even when up to N of them are adversarial.<n>In each global round, the access point partitions the clients into N+1 clusters, trains each cluster independently via vanilla SL, and evaluates their validation losses on a shared dataset.<n>Only the cluster with the lowest loss advances, thereby isolating and discarding malicious updates.
  arXiv  Detail & Related papers  (2025-08-04T09:34:50Z)
• Federated Learning-based MARL for Strengthening Physical-Layer Security in B5G Networks [16.57893415196489]
  This paper explores the application of a federated learning-based multi-agent reinforcement learning (MARL) strategy to enhance physical-layer security (PLS) in a multi-cellular network within the context of beyond 5G networks.<n>At each cell, a base station (BS) operates as a deep reinforcement learning (DRL) agent that interacts with the surrounding environment to maximize the secrecy rate of legitimate users in the presence of an eavesdropper.
  arXiv  Detail & Related papers  (2025-07-09T16:24:15Z)
• Efficient Federated Intrusion Detection in 5G ecosystem using optimized BERT-based model [0.7100520098029439]
  5G offers advanced services, supporting applications such as intelligent transportation, connected healthcare, and smart cities within the Internet of Things (IoT) These advancements introduce significant security challenges, with increasingly sophisticated cyber-attacks. This paper proposes a robust intrusion detection system (IDS) using federated learning and large language models (LLMs)
  arXiv  Detail & Related papers  (2024-09-28T15:56:28Z)
• FedDBL: Communication and Data Efficient Federated Deep-Broad Learning for Histopathological Tissue Classification [65.7405397206767]
  We propose Federated Deep-Broad Learning (FedDBL) to achieve superior classification performance with limited training samples and only one-round communication. FedDBL greatly outperforms the competitors with only one-round communication and limited training samples, while it even achieves comparable performance with the ones under multiple-round communications. Since no data or deep model sharing across different clients, the privacy issue is well-solved and the model security is guaranteed with no model inversion attack risk.
  arXiv  Detail & Related papers  (2023-02-24T14:27:41Z)
• Scalable Collaborative Learning via Representation Sharing [53.047460465980144]
  Federated learning (FL) and Split Learning (SL) are two frameworks that enable collaborative learning while keeping the data private (on device) In FL, each data holder trains a model locally and releases it to a central server for aggregation. In SL, the clients must release individual cut-layer activations (smashed data) to the server and wait for its response (during both inference and back propagation). In this work, we present a novel approach for privacy-preserving machine learning, where the clients collaborate via online knowledge distillation using a contrastive loss.
  arXiv  Detail & Related papers  (2022-11-20T10:49:22Z)
• Artificial Intelligence Empowered Multiple Access for Ultra Reliable and Low Latency THz Wireless Networks [76.89730672544216]
  Terahertz (THz) wireless networks are expected to catalyze the beyond fifth generation (B5G) era. To satisfy the ultra-reliability and low-latency demands of several B5G applications, novel mobility management approaches are required. This article presents a holistic MAC layer approach that enables intelligent user association and resource allocation, as well as flexible and adaptive mobility management.
  arXiv  Detail & Related papers  (2022-08-17T03:00:24Z)
• RelaxLoss: Defending Membership Inference Attacks without Losing Utility [68.48117818874155]
  We propose a novel training framework based on a relaxed loss with a more achievable learning target. RelaxLoss is applicable to any classification model with added benefits of easy implementation and negligible overhead. Our approach consistently outperforms state-of-the-art defense mechanisms in terms of resilience against MIAs.
  arXiv  Detail & Related papers  (2022-07-12T19:34:47Z)
• Robust Federated Learning for execution time-based device model identification under label-flipping attack [0.0]
  Device spoofing and impersonation cyberattacks stand out due to their impact and, usually, low complexity required to be launched. Several solutions have emerged to identify device models and types based on the combination of behavioral fingerprinting and Machine/Deep Learning (ML/DL) techniques. New approaches such as Federated Learning (FL) have not been fully explored yet, especially when malicious clients are present in the scenario setup.
  arXiv  Detail & Related papers  (2021-11-29T10:27:14Z)
• Multi-stage Jamming Attacks Detection using Deep Learning Combined with Kernelized Support Vector Machine in 5G Cloud Radio Access Networks [17.2528983535773]
  This research focuses on deploying a multi-stage machine learning-based intrusion detection (ML-IDS) in 5G C-RAN. It can detect and classify four types of jamming attacks: constant jamming, random jamming, jamming, and reactive jamming. The final classification accuracy of attacks is 94.51% with a 7.84% false negative rate.
  arXiv  Detail & Related papers  (2020-04-13T17:21:45Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.