## 4 Proposed Machine Learning Technique for Detection System
### Design of Intrusion Detection System and Its Operation  
As can be seen in Figure 13, the intrusion detection system consists largely of three modules: 1 Apache Kafka [26] and the traffic data preprocessing module making use of Redis [27] memory DB, 2 the data training module making the most of ML, and 3 the data detection module making the most of ML. Collection systems are required to collect packets transmitted through diverse interfaces in 5G CN as a basic function and to identify and track users from the packet data collected [28]. \begin{table}
\begin{tabular}{c c c} \hline \hline  & \multicolumn{2}{c}{**Actual Outcome and Classification**} \\ \cline{2-3}  & **True** & **False** \\ \hline Predicted Outcome & True & _True Positive_ & _False Positive_ \\ and Classification & False & _False Negative_ & _True Negative_ \\ \hline Where _True Positive_ (TP) is when the model predicts Yes and the actual outcome is also Yes, _False Positive_ (FP) is when the model predicts Yes and the actual output is No, _False Negative_ (FN) is when the model predicts No and the actual output is No. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Confusion matrix and accuracy. Figure 12: Cross-validation method. The system has six file items (elements), as listed in Table 5. It can be divided into: 1 configuration, 2 data, 3 training model, 4 connection module (Apache Kafka and Redis), 5 machine learning (common) module, and 6 signaling DDoS detection process. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Type** & **Item (Element)** & **Subitem (Base Type)** & **Description** \\ \hline Configuration & Config & Config.ini & File that has system configuration info \\ \hline \multirow{4}{*}{Directory} & \multirow{2}{*}{data} & 20210903 & Storage locations of XDR, Bearer and total dataset based on 2021 public key authentication testing \\ \cline{3-4}  & & New date (e.g., 20220711) & Storage location of latest dataset (folder name: date of creation) \\ \cline{3-4}  & \multirow{2}{*}{Model} & 20210903 & Model trained with dataset based on 2021 public key authentication testing \\ \cline{3-4}  & & New date (e.g., 20220711) & Storage location of latest training model (folder name: date of creation, filename: same) \\ \cline{3-4}  & \multirow{2}{*}{Module} & kisaKafka.py & Data streaming (Kafka) module for Kisa 5G \\ \cline{3-4}  & & kisaRedis.py & Memory database (Redis) module for Kisa 5G \\ \hline \multirow{4}{*}{Module} & \multirow{4}{*}{Common} & dataloader.py & Module for loading and managing dataset for training \\ \cline{3-4}  & & model.py & Module for creating and loading training module \\ \cline{3-4}  & & Inference.py & Detection and prediction module \\ \cline{3-4}  & & result.py & Result output module (storage location: /home/ids/result) \\ \cline{3-4}  & & Utils.py & Defines other necessary functions \\ \cline{3-4}  & & Log & Log & Log for exception handling and system processing (storage location: /home/ids/log) \\ \hline \multirow{4}{*}{Process} & \multirow{2}{*}{Detect} & sigdosMLPpreprocessing.py & xDR data preprocessing \\ \cline{3-4}  & & sigdosMLPDetecting.py & Signaling DoS attack detection module \\ \cline{3-4}  & & sigdosMLTraining.py & Module for training ML-based signaling DoS attack detection model (operates upon request) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: File item info of intrusion detection system. Figure 13: Design of intrusion detection system. The \"(c) signaling DDoS detection process\" has three submodules, i.e., machine learning preprocessing module, machine learning training module, and machine learning detecting module. 1. Machine Learning Preprocessing module  
Figure 14 shows the workflow of how a submodule (a part of the overall solution) records/saves the processing time that represents to what extent of data from Redis (memory DB) is taken and processed. It plays the role of flags on postprocessed data informing from what portion the system needs to start processing.