## 5 Experimental Methodology
### DoS Attacks (TCP ACK Flooding) on AMF and NFR  
In the realm of cybersecurity, TCP ACK flooding (known also as PSH-ACK flooding) emerges as a form of DDoS attack, targeting the transport layer implementation on the victim. The core of this attack lies in flooding the victim with an excessive number of TCP packets, each having the ACK and PSH flags set. This is performed to overwhelm the target's available network bandwidth and resources. The PSH flag, in particular, poses an additional burden on the victim as it initiates instant data delivery to the receiving application, bypassing the standard TCP receive buffer handling process. As a result, the victim's capacity to manage legitimate requests and respond to concurrent network traffic becomes severely impaired. Note that unlike SYN flooding, the TCP three-way handshake  
\begin{table}
\begin{tabular}{l l l} \hline \hline  & **OAI** & **Open5 GS** \\ \hline
**Version used** & 1.4.0 & v2.4.11-17 \\ \hline
**Deployment mode supported** & VM, Container, Kubernets & VM, Container, Kubernets \\ \hline
**Protocols supported in SBI** & HTTP/1.1 and HTTP/2 & HTTP/2 \\ \hline
**TLS in SBI** & No & No \\ \hline
**Declared compliance** & Release 16 & Release 16 \\
**3 GPP standard** & Yes, with script & Yes, configuration to be performed manually \\ \hline
**Configuration needed before run** & No & Yes, Configuration on AMF and UPF \\ \hline
**API Adherence to the 3 GPP Rel** & Partial & Partial \\
**16 Standard** & & \\ \hline \hline \end{tabular}
\end{table}
Table 2: Main features of the tested OAI and Open5 GS frameworks.  
has been completed with a multitude of different source port numbers and the connections are in the established state.  
The effectiveness of the attack can be magnified by harnessing a network of compromised devices (botnets) distributed across various locations.  
It is essential to highlight that the AMF encompasses two distinct types of interfaces. The first type comprises interfaces linked to the 5G access network, exemplified by N1 and N2. These interfaces employ a protocol stack that concludes with the NAS protocol and may utilize suitable transport protocols for control plane traffic, such as SCTP implemented on the N2 interface. The second type is the SBI, establishing connections between the AMF and other NFs of the SBA, including NRF, UDM, and PCF. This interface employs TCP to facilitate the RESTful communication model integral to the SBI.  
To mount this TCP ACK flooding attack, we employ **MHDDoS** with the specific configuration parameters reported in Table 3.  
It is important to highlight two notable limitations inherent to this test. Indeed, the absence of a multitude of machines for simultaneous DDoS attack execution and the lack of active users within the network who might experience disruptions constrain the scope of our experimentation. Thus, our evaluation extends primarily to augmenting requests to the NF and assessing its responsiveness in relation to other interfaces within the SBI. Our assessment delves into whether the NF can continue to receive messages from other NFs and fulfill API requests under the duress of the attack.