# Integration of Machine Learning-Based Attack Detectors into Defensive Exercises of a 5G Cyber Range
## 9 Exercises
### 5G Cryptomining Attack Detection Scenario
#### 9.1.4 Description of the Cryptomining Attack Exercise  
The scenario consists of two VMs communicating with each other, as shown in Figure 9. The first VM uses the tcpreplay tool to replay real network traffic from a given PCAP file. This network traffic belongs to existing signaling communication in the 5 GCore based on the use of service-based interfaces (HTTPS) and is generated by user activity in the 5G network (login, registration, deregistration, handover, etc.). Furthermore, there is traffic related to cryptomining activity by an infected component on 5 GCore. Network traffic is generated and stored in a PCAP file in the Machine Learning Lab for this exercise. The second VM consists of the three components described below. * softflowd component: This component receives network traffic, processes it, and sends it to the ELK component for display. * Snort component: This component uses a set of rules to identify unencrypted cryptomining connections from the received network traffic. It also sends alerts to the ELK component. * STA Machine Learning component: This component uses the Tstat tool for feature extraction, processes the obtained data, and makes inferences for each connection. It also sends the labeled connections to the SPIDER control panel for visualization. The trainee will have to use each of these components effectively to solve the proposed exercises. All the phases and processes the blue team needs to perform to complete the cryptomining exercise are described in Figure 10. In the following paragraphs, we describe the exercise and expand upon its different phases. \begin{table}
\begin{tabular}{c c|c|c} \hline \hline
**Model Name** & **Quality Measure** & **Score** & \\ \hline \multirow{4}{*}{\begin{tabular}{c} crypto\_spider\_5g\_rf\_10\_a\_pkl \\ (Good performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.954} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.956} \\  & & **0** & **1** \\ \cline{2-4}  & \multirow{2}{*}{Confusion Matrix} & **0** & **1** \\ \cline{2-4}  & & **0** & 421,968 & 0 \\ \cline{2-4}  & & **1** & 144 & 1494 \\ \hline \multirow{4}{*}{\
\begin{tabular}{c} crypto\_spider\_5g\_rf\_10\_b\_pkl \\ (Medium performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.822} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.855} \\  & & **0** & **1** \\ \cline{2-4}  & Confusion Matrix & **0** & **1** \\ \cline{2-4}  & \multirow{2}{*}{Confusion Matrix} & **0** & 421,940 & 28 \\ \cline{2-4}  & & **1** & 475 & 1163 \\ \hline \multirow{4}{*}{
\begin{tabular}{c} crypto\_spider\_5g\_rf\_10\_c\_pkl \\ (Bad performance) \\ \end{tabular} } & F1-Score & \multicolumn{2}{c}{0.463} \\  & Balanced Accuracy & \multicolumn{2}{c}{0.678} \\  & & **0** & **1** \\ \cline{2-4}  & Confusion Matrix & **0** & **4**21,669 & 299 \\ \cline{2-4}  & & **1** & 1054 & 584 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Quality measures of cryptomining traffic classification models. In the confusion matrices 0: NORMAL, 1: CRYPTO, where rows represent true values and columns predicted values. Figure 10: Cryptomining scenario phases. Figure 9: Cryptomining discovery scenario. In the exercise introduction of Phase A, the blue team is asked to assume the role of a security expert in the SOC (Security Operative Center) of a 5G cloud infrastructure provider. In this scenario, the user receives a ticket from the 5G operator team, reporting that they are experiencing performance problems in their service. The user must, therefore, analyze the traffic provided to them, detect the compromised devices, and identify the malware in the form of encrypted and non-encrypted cryptomining attacks that are impacting the performance. To that end, the user is asked to follow steps that include different detection strategies, including Netflow analysis and the STA component with several inference engines customized for cryptomining detection. Before starting the exercise, as represented by Phase B, the blue team is asked to execute a command that will reset all logs and dashboards of the scenario.