## 3 Related Works  
Initial research on signaling DDoS was undertaken in the general wired network environment rather than the mobile network environment. [PERSON] et al. [22] proposed a technique of detecting general types of DDoS attacks targeting, e.g., ICMP protocol based on the fast entropy method using flow-based analysis. [PERSON] et al. [12] dove into algorithms capable of detecting DDoS attacks utilizing machine learning (ML) in the cloud computing environment.  
Since then, signaling DDoS-focused research in the mobile network environment has also been performed. [PERSON] et al. [21] introduced a threshold-based detection algorithm utilizing sessions to infer signaling DoS events in the CN of the LTE environment. However, the threshold-based detection technique makes it difficult to trace back the locations of trackers in the case of a subtle attack where the attacker uses one terminal, out of a multiple of legitimate terminals, so that peak of attack traffic does not exceed the detection threshold set by network administrators.  
To cope with this drawback, [PERSON] et al. [15] proposed an SVM-based detection method utilizing EBA featuring, with respect to signaling DDoS attacks exploiting wake-up packets in 3G/4G. This ML-based algorithm was trained to quantify its detection performance, using one week of TCP, UDP, and ICMP packets as datasets generated by 62 different smartphones. The experimental result showed a detection rate of 53.8%, indicating that the performance was not worth being applicable in the real field.  
Research on dealing with signaling DDoS attacks in the 5G environment has been focused mainly on attacks trying to take advantage of weaknesses within RRC protocols generally used in the RAN. [PERSON] et al. [16] proposed a randomization-based technique utilizing RRC protocols in the 5G MTC environment, being designed to mitigate the impact of signaling DDoS attacks. In addition, they proposed a robust defense algorithm that can reduce false positives without being affected by exceptional traffic data when a signaling DDoS attacks by abusing the RRC protocol in the 4G/5G MTC environment [10]. They recently also proposed the robust, randomization-based response scheme against signal DoS attacks to disrupt RRC protocols in the 5G MTC environment. However, the result of the performance validation test for the detection rate revealed that detection accuracy was merely 59.8% [17].  
Recently, strategies that adopt deep learning-based detection algorithms have been introduced to defend against signaling DDoS leveraging the RRC protocol, VoLTE Call attack,  
Figure 5: Schematic of signaling DDoS attack.  
and SMS flooding attack. [PERSON] et al. [11] proposed the detection method based on DRC (deep rudimentary CNN) and ResNet (residual network)-50 algorithms to combat three types of DDoS attacks (VoLTE Call attack, RRC signaling attack, and SMS flooding attack) in the 5G CPS environment. The detection algorithm with the DRC (deep rudimentary CNN) algorithm applied exhibited a detection rate of at least 91%, and the algorithm with the ResNet (Residual Network)-50 algorithm applied exhibited a detection rate of at least 97%, both being deemed to be very effective. However, they skipped studies on signaling DDoS attacks in the CN.