# Security Awareness in Software-Defined Multi-Domain 5G Networks
## 2 Related Work
### Security Monitoring and Trust Management  
Security monitoring is a process of collecting, analysing, and inferring security event information in order to gain awareness of a system's security state and trustworthiness as well as to detect and enable responses to security incidents. Monitoring systems collect and share information on events--occurrences that are relevant to the security of the system--from various sources. Networks produce large amounts of event data. Security relevant information is composed of the following categories:  
1. _Network configuration_ information reveals security capabilities and trustworthiness of the hardware and software deployed to the network. This information consists of software configuration of network functions (software vendors, identities, version information, and management practices) and physical configuration of the infrastructure (topology, location of nodes, physical security, hardware vendors, models). Furthermore, the number, location, and configuration of end-user devices, affect the system's security. 2. _Status information_ on available security services allows for keeping track of protected assets. For instance, use of different security protocols, algorithms, firewalls, and secure tunnelling solutions should be monitored and failures recorded. 3. _Traffic statistics_, various counters, and key performance indicators (KPIs) can be used to detect different ongoing threats and attack situations. For instance, abrupt high traffic peaks or resource starvation situations can indicate malicious attacks. 4. _Application data_ flowing through the network can be analysed in detail when packet traces (header and payload data from different protocol layers) are available. Packets can be scanned, e.g., for malware. However, in many cases encryption prevents such inspections anywhere other than in the originating and destination domains. 5. _Detected incidents_ reports are shared across domains to enable common defence actions e.g., against distributed-denial-of-service attacks. Different domains in the security architecture (Figure 2) all produce detailed data from these categories. When sharing information across administrative boundaries (between operator and external network domains) the focus has been on incident reporting that enable common reactions to ongoing attacks such as distributed denial-of-service. As sharing of monitoring data in large volumes is unfeasible and as this data may contain privacy- or business-critical information, security  
Figure 2: Fifth generation (5G) security architecture (adapted from [11; 12]) reflecting security monitoring information that is shared across domains. USIM: user subscriber identity module; RAT: Radio Access Technology; IM: identity management; KPI: key performance indicator; MEHW: mobile equipment hardware; UICC: universal integrated-circuit card; IP: internet protocol. analyses are typically performed locally within administrative domains. However, there is a need for cross-domain sharing of coarse-grained data on network trust compliance. Further, sharing of more detailed information on configuration, statuses, and KPIs is beneficial when it enables mitigations of more subtle threats. Security monitoring is not a specific theme in 3 GPP. However, 3 GPP has specified [13; 14] hundreds of counters and KPIs to monitor, assess, and optimize mobile networks' operability and efficiency. These KPIs include parameters related to the performance of radio interface, network services, and user's experience. Some of these counters and KPIs also function as security indicators. Actually, all abnormal or unsuccessful incidents in network systems, such as failed handovers or connection setups, are by default carefully counted, and the reasons for failures are recorded whenever possible. Furthermore, all major mobile system vendors (Nokia, Ericsson, Huawei and others) have extended the standard approach and they provide advanced software products for network performance and security monitoring as well as management.