## 1 Introduction
According to Gartner, the development of private deployments, vertical applications, cloud architecture, and enormous IoT connections in 5G offer new risks and problems, such as potential DDoS attack routes and access points, making 5G network security a concern for cloud solution providers (CSPs) and companies [9]. As shown in Figure 2, the environment to provide 5G services can be categorized broadly into four surface (plane) domains: firstly, user equipment (UE) surface; secondly, radio access ntwork (RAN) surface; thirdly, core network (CN) surface; and fourthly, service  
Figure 1: Memcached reflection DDoS attack traffic volume [4]. surface. Therefore, 5G infrastructure-involved DDoS attacks may target the RAN surface, CN surface, and service surface. Attacks in the service surface are usually targeted on voice service that is the most basic service that mobile service providers offer. In the 5G mobile communication network, voice services use Session Initiation Protocol (SIP), the vulnerability of which is often exploited by DDoS attackers with a final target being the IP Multimedia Subsystem (IMS). Prior research on DDoS mitigation methods, simply put, include those studies focused on attacks abusing radio resource control (RRC) protocol, and those focused on attacks abusing the SIP used for voice and SMS services [10,11]. Nevertheless, to the best of our knowledge, there is little or no research focused on DDoS attacks targeting the CN. Unlike the RAN, the CN is a central conduit acting as the backbone network, so once crashed by a DDoS attack, the consequence is disastrous, with far greater ripple effect, in contrast with the base station whose impact arising from failure is limited to its geographical coverage. DDoS attacks targeting the CN usually use techniques called signaling DoS. Since it can be hard to differentiate malicious traffic from legitimate traffic, signature generation techniques are insufficient to detect them [12]. To detect signaling DDoS attacks in 5G, it is inevitably required to analyze 5G network traffic. As defined by the International Telecommunication Union (ITU), one of the leading international standards organizations, the minimum requirement for the download peak data rate in 5G mobile communication technology is 20 Gbps per user [13]. It contnotes that the 5G network must shoulder traffic in the Tbps level even when there are only 50 users in an independent network. According to the Ericsson Mobility Report, mobile data traffic has increased almost 300-fold since 2011 [14]. To deal with the large volume of traffic, it is crucial to facilitate statistical analysis methods, not relying on a single network packet. Efficient analysis tools are further required, such as machine learning (ML)-based algorithms capable of analyzing huge amounts of data as quickly as possible. There are a lot of studies attempting to detect signaling DoS using conventional ML-based algorithms, which are, however, not applicable for signaling DoS attacks targeting the CN in 5G. What is worse, those prior studies reveal the very low efficiency, with a detection rate of between 50% and 60% [15, 16, 17]. Under a situation such as that, the present study proposes a signaling DDoS detection method for security inside the CN infrastructure in 5G, which utilizes ML-based algorithms incorporating entropy-based analysis (EBA) and statistics-based analysis (SBA) techniques. How to evaluate the proposed method is also provided in this paper. The contribution of this article is summarized as follows:  
Figure 2: A 5G cyber attack surface. We proposed, for the first time in the relevant field, a method to mitigate signaling DDoS attacks and a detection system utilizing that method, with respect to CN protocol (HTTP/2, PFCP) in the 5G SA environment. 2. We presented a statistical- and probabilistic-based analysis technique capable of more precisely detecting signaling DDoS attacks in the 5G SA environment in which large-volume traffic flows. 3.