# Effective Feature Selection Methods to Detect IoT DDoS Attack in 5G Core Network
## 4 Problem Define and Experimental Design
### Experimental Design
#### 4.2.2 5G Dataset Collection  
The 5G datasets were collected by dumping the switch equipment between the gNB and the UPF in the experimental environment described in Section 4.2.1. The assumptions and detailed processes for collecting these datasets are described in the following subsections. (1) Dataset Used (Kitsune)  
This study utilized the Kitsune Network Attack Dataset [18; 19] developed at Ben-Gurion University in Israel in 2018 (updated up to 2020). The Kitsune dataset provides a total of 21,017,596 network packets for 9 individual attacks among 4 types of real network intrusion attacks (Table 1). The Kitsune dataset consists of network packets of similar IPs (unlike other datasets that use different IPs) for each attack on normal and malicious traffic. In [19], three file types for each attack are provided: extracted features (CSV files) extracted using an afterimage feature extractor [18], labeled packets (CSV files), and the original network packets (PCAP file). \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attack Type** & **Attack Name** & **Benign Packets** & **Malicious Packets** & **Total Packets** \\ \hline \multirow{2}{*}{Reconnaissance} & OS Scan & 1,632,151 & 65,700 & 1,697,851 \\  & Fuzzing & 1,811,356 & 432,783 & 2,244,139 \\ \hline \multirow{3}{*}{Man in the Middle} & Video Injection & 102,499 & 2,369,902 & 2,472,401 \\  & ARP MitM & 1,358,995 & 1,145,272 & 2,504,267 \\  & Active Wiretap & 1,355,473 & 923,216 & 2,278,689 \\ \hline \multirow{3}{*}{Denial of Service} & SSDP Flood & 2,637,662 & 1,439,604 & 4,077,266 \\  & SYN DoS & 7038 & 2,764,238 & 2,771,276 \\ \cline{1-1}  & SSL Renegotiation & 2,114,919 & 92,652 & 2,207,571 \\ \hline Botnet Malware & Mirai & 121,620 & 642,516 & 764,136 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The number of attack packets by attack type of the Kitsune dataset. Figure 4: Experimental 5G environment of a 5G mobile network (UERANSIM + Open5 GS). This study used TEID features influenced by source and destination IPs. Hence, the Kitsune dataset was used, which consists of similar IPs for each attack. Furthermore, a PCAP file and a CSV file with labeled packets were used to relay the packets in the 5 GC network. (2) Packet Sampling  
Two out of the nine attacks (Mirai, Video Injection) from [19] were excluded for the purpose of this experiment. Hence, the seven attacks utilized in this study were OS Scan, Fuzzing, ARP MitM, Active Wiretap, SSDP Flood, SYN DoS, and SSL Renegotiation. To configure the same environment (i.e., number of network packets used) for each attack, SYN DoS with the smallest number of network packets was applied as the standard. The number of sampled network packets was set to 6500 to account for possible losses during the process of classifying benign and malicious packets in a PCAP file. Furthermore, all source and destination IP pairs were taken into consideration to reduce the dataset bias that may occur during the sampling process. In addition, to avoid biased results, the number of benign to malicious network packets per attack was matched in a 1:1 ratio. The process of sampling 6500 packets, as shown in Figure 5, is described below. 1. Based on the CSV file labeled per packet, benign and malicious packets are separated from the original PCAP file and saved as a separate PCAP file. 2. Up to 7000 packets for each source and destination IP pair in benign and malicious PCAP files saved in step 1 are randomly sampled and stored. 3. Using the source and destination IP sampling packets saved in step 2, the sampling data are saved based on the source IP. 4. A total of 6500 network packets, including all types of source and destination IP pairs, are sampled using sampling data based on the source IP (saved in step 3). 5. Consequently, a PCAP file is generated for each benign or malicious packet attack for a total of 14 PCAP files. 3. GTP-U Packet Collection  
To collect GTP packets under the most realistic 5G network conditions, the test environment described in Section 4.2.1 was constructed.