# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 2 Related Work
### 5G Core Network DDoS Attacks
#### 2.2. 5G Core Network DDoS Attack Detection Methods  
In 5G core networks, DDoS attacks are a common attack method that cause network paralysis or failure to operate properly by occupying a large amount of network resources. In order to detect DDoS attacks, several methods can be adopted. Over the past two years, trends in DDoS attacks have led researchers to analyze several mitigation strategies based on software-defined networking (SDN), network function virtualization (NFV), and mobile target defense [15], while emphasizing several challenges encountered when employing innovative technologies to counteract DDoS attacks. [PERSON] [16] and colleagues introduced a security approach for 5G networks that mitigates DDoS attacks by actively managing threat responses. Their method utilizes a reactive, event-focused security policy language, fostering a flexible, efficient, and lightweight defense strategy. [PERSON], [PERSON] et al. [17] introduced an innovative method to address the shortcomings of conventional detection systems. They developed a new sensor that can collect the necessary data to trace an attacker even if the attacker is moving across multiple locations. Furthermore, the authors of [18] proposed an autonomous security system--comprising its design, implementation, and empirical validation--that effectively shields networks from Distributed Denial of Service (DDoS) attacks by autonomously selecting and executing appropriate countermeasures without human intervention. [PERSON] [19] and colleagues introduced an extensible authentication protocol called EAP-ZKP which is applicable in both initial and subsequent authentication stages to help mitigate DDoS attacks along the CN edge. A novel defense framework [20] integrates real-time threat detection with proactive mitigation to neutralize signaling-based DDoS attacks in 5G standalone core networks. Some researchers used a novel [21] enhanced naive Bayes algorithm. This method not only examines both the independent and interdependent aspects of features through structural improvements but also employs a genetic algorithm to identify the optimal combination of attribute weights for effective categorization. A hybrid classification framework for 5G DDoS attacks combining deep neural networks with a modified equilibrium optimization algorithm (MEOADL-ADC) was proposed in [22], achieving superior detection accuracy through adaptive feature learning and parameter optimization. Based on an actor-critic reinforcement learning framework [23], Slice Isolation-Based Reinforcement Learning (SIRL) mitigates DDoS attacks in Beyond-5G networks by dynamically configuring a graph-based environment. The model leverages five optimized graph features to represent network states and employs a ranking-driven adjustment mechanism to adapt its defense strategy in real time, enhancing resilience against evolving attack patterns. The deep learning frame work in [24; 25] detects DDoS attacks in 5G slices and deploys a resource-minimal sinkhole slice to isolate malicious traffic, which was validated in a 5G prototype for autonomous attack containment. The DDoS intrusion detection framework in [26] was designed for dynamic IoT environments, effectively counteracting one of the top threats to data flow in IoT networks. Their approach utilizes a Kalman backpropagation neural network to enhance the detection and mitigation of DDoS attacks. The federated-learning framework in [27] enables privacy-preserving DDoS detection on the GTP protocol in 5G core networks by aggregating distributed device intelligence for real-time attack identification. This approach eliminates centralized data sharing while maintaining detection accuracy through collaborative model training across network nodes. [PERSON], [PERSON] [28] and colleagues proposed a countermeasure against DDoS attacks in the 5G context by integrating smart contracts with machine learning. Their approach conceals a secure server within a blockchain network and dynamically controls the scale of attacks through adjustments in transaction fees.