# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 2 Related Work
### 5G Core Network DDoS Attacks
This request is then forwarded to the AMF, a component within the 5G core network responsible for handling access requests and mobility management. The AMF queries the necessary service information through the NRF, which acts as a service discovery and registration center, aiding the AMF in locating the appropriate services. The AMF sends an authentication request to the AUSF, which is tasked with executing user identity authentication. The AUSF authenticates the UE, which may involve using SIM card information, network authentication tokens, or other authentication mechanisms. If the authentication is successful, the AMF sends a 201 status code to the UE, indicating successful resource creation, and the registration process can proceed. The AMF may need to obtain the URL of the PCF from the NRF for policy control purposes. The AMF interacts with the PCF, which \begin{table}
\begin{tabular}{c c} \hline
**Interface** & **Functions** \\ \hline N1 & UE-AMF \\ N2 & gNB-AMF \\ N3 & gNB-UPF \\ N4 & SMF-UPF \\ N5 & PCF-AF \\ N6 & UPF-DN \\ N7 & SMF-PCF \\ N8 & AMF-UDM \\ N9 & UPF-UPF \\ N10 & SMF-PCF \\ N11 & AMF-SMF \\ N12 & AUSF-AMF \\ N13 & AUSF-UDM \\ N14 & AMF-AMF \\ N15 & AMF-PCF \\ N22 & AMF-NSSF \\ \hline \end{tabular}
\end{table} 
Table 1: 5G core network interface functions. Figure 3: PFCP structure. Source: [12]. makes decisions based on the UE's policy requirements, such as QoS rules. The AMF also interacts with the UDM, which is responsible for managing user identities, subscription information, and other data. The SMF is in charge of establishing, modifying, and releasing sessions, working in coordination with the AMF to ensure session continuity. The UPF is responsible for forwarding data to the correct destination. With the completion of the registration process with the 5G network, the UE can now begin using 5G network services. PFCP is primarily used to establish, modify, and delete sessions between the SMF and UPF [13] as well as to control and manage traffic. The message interaction workflow is illustrated in Figure 4.  
The message interaction workflow includes three sessions. The operational principles and functions of each session are as follows:  
* Session establishment: When a UE accesses the 5G network and initiates a service request, the SMF sends a session establishment request to the UPF via PFCP. This request includes session-related parameters such as user identification, service type, and QoS requirements. The UPF creates the corresponding session context based on these parameters and allocates resources to ensure correct transmission of user traffic on the user plane. * Session modification: During the course of a session, if there is a change in business requirements, such as a user switching from watching a video to engaging in a video call, which entails different QoS requirements for bandwidth and latency, the SMF can send a session modification request to the UPF via the PFCP protocol. The UPF then adjusts resource allocation and traffic handling strategies based on the modified parameters to accommodate the new business requirements. * Session deletion: When a user terminates a service or when the network side needs to release resources, the SMF sends a session deletion request to the UPF. Upon receiving the request, the UPF releases resources associated with the session, such as closing tunnels and reclaiming bandwidth, thereby completing the session deletion process. In accordance with the current knowledge related to the PFCP, we can present PFCP exhibits certain network security risks. There are four common types of attacks targeting the PFCP in the core of 5G [14]. These attacks primarily focus on the communication between the SMF and UPF. The four different types of attack principles are as follows:  
Figure 4: Working principle of PFCP message exchange. Source: [13]. 1. PFCP session establishment DDoS attack: This attack is designed to deplete the UPF's resources by inundating it with numerous legitimate session initiation and heartbeat messages.