# [UOM - Free5 gc]
## 6 B5 gemini Use Cases
### Cyber-Attack Use Cases on Cloud 5G Infrastructure  
One of the most relevant issues in 5G and beyond is security. The evolution towards distributed solutions in the cloud, with multiple providers and hyperscalers, can represent a handicap at the security level for future 5G services, since the network operators will not have absolute control of the infrastructure. Analyzing the capacities and performance of AI-based solutions to address attacks to the cloud environments represents an interesting topic. Using an NDT with 5G functionalities, based on NFV and cloud architectures, allows one to introduce attacks in the virtual environment without causing harmful situations on the physical system and related 5G services. In this way, this approach serves as a foundation to enable advanced AI-based solutions. On this basis, some cybersecurity attacks are proposed with an NDT 5G cloud environment with generalized encryption (at signaling and data plane levels). A first case to be evaluated in the NDT is an attack on the illegal consumption of resources due to the presence of malware. The cryptomining variant of malware (intensive use of CPU and memory resources for cryptocurrency mining) is a lucrative criminal activity today, impacting the performance and cost of certain cloud services. Analyzing and classifying the traffic that is generated, with AI models in an NDT environment, allows the creation and evaluation of tools to block this activity. Another case is the attack to the DNS, a critical service in 5G cloud infrastructure. Today, there is a progressive adoption of DoH protocol (RFC 8484), with a secure HTTPS layer for DNS resolution to increase user privacy. Precisely, the activation of this protocol variant in an NDT opens the possibility to study how flooding or other attacks variants affects the cloud infrastructure and provides a mechanism to detect the attack using AI. In terms of Cloud 5G solutions deployment, we can consider several scenarios: native cloud, on-premises, or hybrid solutions (i.e., on-premises but integrated into cloud management to address regulatory aspects). In relation to the two-way communication capabilities that an NDT provides, and the information exchanged between the two parties (the NDT and the physical system), it should be noted that management systems support templates to automate deployments and simplify replications. These templates can be used as the automatic system input feed to the NDT (Section 3.3.1) for initial deploymentsof the NDT, on a reduced scale. For example, the 5G component, such AMF or UPF, can be deployed with few resources to manage reduced user traffic volume. Additionally, hyperscalers and on-premise setups have the capacity to deliver rich information based on supported API, including telemetry information (activity loads, traffic volume, etc.). This information can be understood as part of P2V pipeline input (Section 3.3.4), which will enrich the NDT behavior, such as statistical traffic profiles and behavioral patterns for the traffic generation (Section 3.3.5) and combine with cryptomining and DoH-related attacks. The NDT results will provide a customized AL/ML output (Section 3.3.6) to deploy again using the P2V channel. Nothing limits a dynamic interaction between real Cloud 5G Core and its NDT over time to improve the ML detection. This is possible because most of the workload falls on the side of the NDT (rebalance traffics generation types, attacks patterns, and re-train ML models), and avoids affections to production networks loads and costs that are focused on providing the 5G service. One potential advantage in the cybersecurity case for NDT is that we can limit the P2V data feed to only one direction of communication (from the real network to the NDT). The other direction feed (ML model updates), which implies changes in the production cloud, can be performed through the secured pre-existing management channels (i.e., through the provisioning system).