## 4 Solution of Requirements and Inspection Methods
### Active Defense Mechanism Enhances Broadband Network Resilience
It gathers and automatically analyzes digital evidence with threat indicators, additionally referencing the MITRE ATT&CK framework proposed by the U.S. non-profit organization MITRE [48; 50]. For each stage of the attack, MITRE collects the techniques and tools used by attackers. Referring to known threat patterns, it executes risk assessments, visualizes threats and risks, reports to the cybersecurity management team, and issues alerts. The deployment of the EDR mechanism in the 5G core network of satellite ground receiving stations for log containment and analysis is illustrated in Figure 33. Corresponding with cybersecurity frameworks such as MITRE ATT&CK, DJFEND [51; 52], as well as relevant guidelines and recommendations, it develops anomaly and attack behavior detection to uncover potential attack patterns. This involves the analysis of network architecture threat vulnerabilities and attack contexts, contributing to the development of proactive defense strategies and solutions. The 5G core network commercial product developed by free 5G core network, an open-source architecture for the 5G core network, served as the experimental field for this study. The 5G core network complies with the specifications of 3 GPP R15/R16, defining  
Figure 33: Illustration of EDR deployment in 5G core network. Figure 32: Operational flowchart for satellite—5 GC NR log containment. the 5G core network as a decomposable network architecture aimed at introducing the concept of control and user interface separation. Its architecture is illustrated in Figure 34.  
Among these components, the network slice selection function (NSSF) selects suitable network slices through network slice selection assistance information (NSSAI) provided by user equipment (UE). Unified data management (UDM) is responsible for user data management, storage, and configuration. The policy control function (PCF) provides network policies for all control plane functions. The unified data repository (UDR) serves as a unified data storage for UDM and PCF. The network exposure function (NEF) manages external open data access interfaces. The network repository function (NRF) handles functions such as registration, management, and status detection for the NEF. The authentication server function (AUSF) authenticates UE access. The user plane function (UPF) manages user packet routing and forwarding, interactions with the data network (DN), quality of service (QoS) processing for the user plane, and traffic control implementation. The access and mobility management function (AMF) provides authentication and authorization for user access. The session management function (SMF) is responsible for call channel maintenance, IP allocation management, and UPF selection. Additionally, in the context of the DN, composed of interconnected devices and systems for transmitting and exchanging data in communications, the UPF of the core network supports data routing, forwarding, inspection, and QoS. It serves as an external packet data unit (PDU) node interconnecting with the DN and acts as an anchor for intra- and inter-radio access technology (Inter-RAT) mobility. The control interface of the core network employs a service-oriented architecture design principle. Different control interface network units provide various network function services through API services. This architectural design allows the core network to support multiple network function services and provides flexible integration and reconstruction capabilities. Through standardized interfaces, it enhances the flexibility and openness of the core network. (2). Log Containment  
The purpose of log containment is to record and trace critical events, errors, and network activities to assist network administrators in troubleshooting and network maintenance. When system issues or errors occur, log records can provide detailed messages about the occurrence of errors, helping to identify and resolve issues, thereby improving network availability and performance.