# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 2 Related Work
### 5G Core Network DDoS Attacks  
The structure of the 5G core network [5; 6] is primarily composed of three main components: the access network layer, the transport network layer, and the core network layer. The access network layer is mainly composed of base stations, and is responsible for the access and management of user equipment (UE) on the wireless side. In 5G, the access network adopts a Centralized Unit (CU) and Distributed Unit (DU) architecture. The CU handles baseband processing such as channel coding and modulation, while the DU is responsible for radio frequency processing such as filtering and power amplification. This architecture optimizes the signal processing process, enhancing network efficiency and performance. The transport network layer [7] consists of a series of operator-owned switching and routing devices, primarily used for transmitting control signaling and user data between the base stations and the core network. The design and implementation of the transport network are crucial for ensuring the efficiency and stability of data transmission. The core network layer deploys a series of core network elements which are responsible for terminal user access and mobility management as well as processing user services. The architecture design and implementation of the core network directly impact the network's availability, reliability, and performance. As illustrated in Figure 2, the 5G core network architecture [8] comprises the following network functions: Network Slice Selection Function (NSSF), Network Exposure Function (NEF), Network Repository Function (NRF), Policy Control Function (PCF), User Data Management (UDM), Access and Mobility Management Function (AMF), Authentication Server Function (AUSF), Access Management Function (AMF), Session Management Function (SMF), and User Plane Function (UPF). Table 1 illustrates the communication interfaces [10] between various modules in the 5G core network, with the N4 interface serving as the bridge between the UPF and the SMF. The establishment and updating of the N4 interface can be initiated by either the SMF or the UPF; however, the release process is always initiated by the SMF. During the update process, the N4 interface is notified of changes in the network function support characteristics, and the UPF can also use the update process to inform the SMF of resource availability or request that the SMF initiate the release process. Therefore, the N4 interface is particularly noteworthy in the 5G core network and is also a key area for attack prevention. In this paper, our primary concern revolves around the security challenges associated with the PFCP, a protocol that finds its application in the N4 interface between the SMF and the UPF within the 5G core network. Figure 2: 5G core network structure. Source: [9]. The control plane protocol [11] used for the N4 interface between SMF and UPF is the PFCP protocol, which is defined in the TS 29.244 specification. This protocol is primarily used for SMF to instruct UPF on packet forwarding. The structure of the PFCP message is illustrated in Figure 3. The PFCP consists of a protocol header followed by subsequent Information Elements (IEs). The header contains several key fields, such as the Session Endpoint ID (SEID), MP flag, version, message type, and message length. These fields provide the necessary information and control mechanisms for communication between SMF and UPF. Specifically, the SEID is used to identify and control the amount of subsequent packet content, while the MP flag and version information are used to identify the state and version of the protocol. The message type and message length provide information about the specific content and length of the current message. Together, these pieces of information ensure efficient and accurate communication between the SMF and UPF. The UE sends an NAS registration request [11]. The gNodeB (gNB), which is the base station of the 5G radio access network, receives the registration request from the UE.