# Detection Model for 5G Core PFCP DDoS Attacks Based on Sin-Cos-bIAVOa
## 3 Method
### PFCPD DDoS Attack Detection Model  
DDoS attack detection is part of the Detect functionality within the Core category of the NIST Cybersecurity Framework. Specifically, this function aims to identify potential cybersecurity incidents through continuous monitoring and anomaly analysis, with DDoS attack detection serving as a key technology for recognizing abnormal traffic or malicious behavior.The control plane of the 5G core network adopts a service-based architecture design. In this service-based architecture, network elements are connected to the same  
Figure 7: Sin-Cos transfer function.  
line, each with a service-based interface that allows them to interact with other network elements externally. As illustrated in Figure 8, the 5G network is a packet-switched network, in which the concepts of the control plane and the user plane have always existed. The control plane and user plane are categorized based on the type of data they handle; the control plane is responsible for transmitting control signaling (signaling interaction), while the user plane is responsible for transmitting actual data.  
Taking the N4 interface as an example, this paper considers the potential risks in the communication process between the UPF and the SMF. First, the UPF communicates directly with the operator's data network, and its ports may be exposed to the public network; additionally, due to the separation of control plane and user plane in the 5 GC architecture, the UPF needs to be deployed at the network edge, increasing the risk of exposure. The establishment process of the N4 interface is initiated by the SMF and sent to the UPF. If the UPF lacks a robust authentication mechanism for network elements, attackers could impersonate the SMF to launch attacks on the UPF. The PFCP protocol supports several business processes, including session establishment, session modification, session deletion, and session reporting. After establishing a connection with the UPF using a forged SMF, attackers can exploit the session modification process to redirect user plane data packets for data theft or can use the session deletion process to deny service to certain users.  
DDoS attacks on the 5G core network occur primarily between the SMF and UPF units. Therefore, deploying traffic collection probes at the N4 interface to collect and analyze network traffic on the N4 interface can most effectively enable DDoS attack detection and early warning.  
The entire traffic detection system comprises four main components: traffic collection, data preprocessing, data analysis, and attack alerting. Among these, data preprocessing and data analysis are the most critical, with their algorithmic principles and models illustrated in Figure 9.  
Figure 8: Network structure of the 5G core PFCP DDoS attack detection model.  
The detection model obtains raw traffic data from the traffic probe. Traffic packets are parsed according to the TCP/IP protocol format, with layered parsing of network layer TCP/IP protocol data and application layer PFCP protocol data, and feature values are extracted to form a dataset. Based on different timeout durations (15 s, 20 s, 60 s, 120 s, 240 s), PFCP protocol sessions are statistically integrated. Session data are detected using the Sincos-bIAVOA algorithm. Finally, the detection results are summarized and comprehensively analyzed to generate DDoS alert information for output. The attack detection model captures network data through the N4 interface and accurately identifies both attack packets and attack sessions by analyzing multiple timeout dimensions, enabling the detection of PFCP DDoS attacks in the 5G core network. This model represents an innovative practical application of the Sin-Cos-bIAVOA algorithm, achieving attack detection through a comprehensive process that encompasses data collection, data integration, and data analysis and processing.