## 4 Measuring the Effect of the DoS Attack on 3G Networks
Hence, by using this kind of a solution, we protect customers and mobile core network infrastructure against only TCP SYN based attacks. Although our routers provide only TCP SYN based attack protection, we notice that the number of paging on RNC decreases after the TCP based Access Control List (ACL) is applied. To ensure the positive effect, we temporarily disabled TCP based ACL on our Internet router and observed the paging activity and resource usage of our core network devices. After we applied TCP based ACL on our Internet routers again, the paging activity and CPU usage was influenced positively as shown with the graphs in Figures 9 and 10. In these graphs, the horizontal axis shows time and date, and the vertical axis shows the CPU usage. These graphs have a sampling period of 1875 s. As seen in these graphs, the CPU usage on the RNC and SGSN decrease by approximately 25%, compared to the values when the ACL is not applied. Figure 7: Network designed without a security solution. These results do not mean that we are under a TCP SYN based attack all the time but there is some TCP based traffic from the Internet to our 3G subscribers' subnet. Therefore, the CPU usage is decreasing after applying the TCP based ACL that blocks the unnecessary traffic from the Internet. Paging activity on the RNC also decreased from 240,000 to 160,000, _i.e._, by approximately 33%, after applying the ACL on the Internet router, as shown in Figure 11 where the vertical and horizontal axes show the number of paging activity and date/time, respectively. Figure 8: Mobile device’s intrusion prevention (IP) connectivity. Figure 10: RNC CPU usage with/without TCP ACL. Figure 9: Serving GPRS support node (SGSN) CPU usage with/without TCP access control list (ACL). These results made us also think about the risks that could occur due to UDP based attacks. Therefore, using UDP packets, we performed some attacks against our 3G network. By using some free open source tools, we sent UDP packets of size 60 bytes at a rate of 60,000 to 100,000 packets per second from the Internet to our 3G network. We performed our attacks at midnight between 02:30 and 03:00 a.m. to minimize the adverse effects to the customers. During these attacks, the number of paging and amount of CPU usage on our core network devices dramatically increased as shown in Figure 12. As seen in the figure, the RNC's PS paging attempt count was 70,000 just before attack and during the attack it reached 283,000. Hence, the number of pagings increased by approximately 304% due to our attack. PS paging activity dramatically increased on the RNC and SGSN when we sent bulk data traffic to the subnets of the 3G subscribers. However, CS paging [23] is not affected during that time. Both the PS and CS paging activity decreased after midnight due to the decreasing number of phone calls. Figure 13  
Figure 11: Number of paging activity on an radio network controller (RNC) with/without applying an ACL. Figure 12: RNC PS paging attempts during the user datagram protocol (UDP) based attacks (sampling period is 30 min). shows how the same RNC's CS paging activity changes during the same time interval. This shows that the PS paging and the CS paging are used for different purposes. The CS and PS paging activities are triggered by the MSC and GGSN, respectively. In other words, PS paging is data-oriented and CS paging is voice-oriented. They use different signaling channels until the RNC. However, they use the same control channel from the RNC to NodeB. Therefore, all voice and data transmission can be effected if it is overloaded by an attacker who exploits PS paging. During our attacks, we observed that the CPU usage of an RNC increased. In Figure 14, the RNC CPU usage during the UDP attack is given with a sampling period of 1875 s.  
In this work, we first examined the effect of unwanted data traffic on cellular network devices such as the RNC and SGSN.