# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 1 Introduction
In a denial of service attack, hackers may launch a denial of service attack on the 5G core network, paralyzing network services or reducing service quality. Attackers can forge legitimate IP addresses to construct malicious packets, exploiting the IP protocol's source address validation flaw to bypass security checks. Additionally, protocol vulnerabilities may be used to alter user plane data, or key reinstallation attacks can be employed to compromise encryption safeguards. Attackers can exploit vulnerabilities in the virtualization management plane, forge session management signaling, and steal user-plane traffic. Spoofing attacks also pose a severe threat to the security of the 5G core network, as attackers may disguise themselves as legitimate users or entities in order to gain unauthorized access, steal sensitive information, or spread malicious software. The control plane of the 5G Core Network(5 GCN) [4] is essential for enabling reliable and high-performance 5G communications by delivering critical services such as authentication, user credential management, and privacy-sensitive signaling. However, the threat landscape has broadened significantly, and the control plane now encounters serious security risks from a variety of sources and interfaces. External network attackers can flood the 5G core network with numerous service requests, overwhelming system resources and impeding legitimate users' access to services. There have not been very many studies investigating the security issues of the 5 GCN control plane. This paper focuses on security issues of the Packet Forwarding Control Protocol (PFCP) utilized in the N4 interface between the Session Management Function (SMF) and the User Plane Function (UPF) in the 5G core network. The study analyzes the characteristics of PFCP DDoS attacks in 5G core networks and explores effective solutions for detecting PFCP DDoS attacks. The main contributions of this study can be summarized as follows: in Section 2 (Related Work), we conduct an analysis of the PFCP operational mechanisms and the principles of DDoS attacks targeting this protocol; in Section 4 (Experimental Results and Analysis), we propose a Sin-Cos-BIAVOA-based multi-session duration comprehensive analysis PFCP DDoS attack detection model for the PFCP session mechanism; in Section 4.3 (Effectiveness Evaluation Experiment), we utilize publicly available datasets to validate the detection effectiveness of the model in both single-packet DDoS attack scenarios and mixed-packet DDoS attack scenarios; finally, Section 4.4 (Accuracy Comparison Evaluation Experiment) and Section 4.5 (Experiment on the Classification and Identification of Attack Types) describe comparative experiments between our proposed model and traditional machine learning and deep learning methods to evaluate the model's detection accuracy, detection efficiency, and other aspects. Based on the previous remarks, the rest of this paper is organized as follows: Section 2 introduces the research progress in the field of AI-based DDoS attack detection; Section 3 describes the proposed 5G core PFCP DDoS attack detection method; Section 4 discusses the experimental results and evaluates the method; finally, Section 5 provides the concluding remarks of the paper.