# 5G Security Threat Assessment in Real Networks
## 8 Countermeasures and Future Work
### Technical Countermeasures  
This subsection describes technical countermeasures against 5G security threats. First, a system configuration for response will be presented, followed by an algorithm that can detect the threats.  
**System Architecture for Countermeasure**. As shown in Figure 12, Probe and IDS are configured with traffic-based security threat detection system and IPS is configured with packet-based security threat detection system. The detection information generated from each system is monitored by the security information and event management (SIEM) and relayed to the operators.  
**Information Leak (GTP-in-GTP: echo request)**. Following Algorithm 1 is the detection algorithm for traffic that scans MME, SGW or PGW IP through the GTP-in-GTP packet injection attack in the countermeasure architecture mentioned above.  
```
Data: (1) Value of Identification a IP Packet N(P) (2) Destination Port of the IP Packet DP(P), Destination Port of Payload in the IP Packet DP(Pin) (3) two protocols Gc, Gu, and the Destination Ports of these two protocols DP(Gc), DP(Gu) (4) Value of Upper 2 Bytes of Payload in the IP Packet UB(Pin) (5) Flags Header's values of GTP-C Echo Request messages F(Gce) (6) Payload's Length in the IP Packet L(Pin), Value of Message Length Header of Payload in the IP Packet ML(Pin) Result: Scanning Detection Result of the IP Packet from 5G UE to 5G EPC SD(P) \(DP\) (\(Gc\)) = 2123; // GTP-C Port Number \(DP\) (\(Gu\)) = 2152; // GTP-U Port Number \(F\) (\(Gc\)) = 4001; // Flag if \(DP\) (\(p\)) == \(DP\) (Gu)&\(\&DP\) (\(Pin\)) == \(DP\) (\(Gc\)) then  UB(Pin) = Value of Upper 2 Bytes of Payload; if \(\mathit{ULB}(\mathit{Pin})==F\) (\(Gc\)) then  L(Pin) = Payload's Lengths;  ML(Pin) = Value of Message Length Header of Payload;  SD(P) = 0; if \(\mathit{L}(\mathit{Pin})==21\&\&\mathit{ML}(\mathit{Pin})==9\) then  SD(P) = 1; else  end if  else  end if  return SD(P) and N(P);
```  
**Algorithm 1**Scanning traffic detection algorithm.  
**Algorithm 2**Scanning detection algorithm.  
Figure 12: System architecture for 5G security threat countermeasure.  
**IP Depletion (random create session request).** Following Algorithm 2 is the detection algorithm for Resource Exhaustion traffic that maliciously induce IP allocations carried out by PGW in the countermeasure architecture mentioned above.  
```
Data: (1) Value of Identification a IP Packet N(P) (2) Destination Port of the IP Packet DP(P), Destination Port of Payload in the IP Packet DP(Pin) (3) two protocols Gc, Gu, and the Destination Ports of these two protocols DP(Gc), DP(Gu) (4) Value of Upper 2 Bytes of Payload in the IP Packet UB(Pin), Value of Upper 12 th 1 Byte of Payload in the IP Packet UB12(Pin) (5) Flags Header's value of GTP-C Create Session Request messages F(Gcc), Spare Header's value of GTP-C Create Session Request message S(Gcc) (6) Payload's Length in the IP Packet L(Pin), Value of Message Length Header of Payload in the IP Packet ML(Pin), Message Length of Create Session Request message in the IP Packet MLc(Pin) Result: Resource Exhaustion Detection Result of the IP Packet from 5G UE to 5G EPC RED(P) \(DP\) (Gc) = 2123; // GTP-C Port Number \(DP\) (Gu) = 2152; // GTP-U Port Number \(F\) (Gcc) = 4820; \(S\) (Gcc) = 0; if DP (P) == DP (Gu)&&DP (Pin) == DP (Gc) then  UB(Pin) = Value of Upper 2 Bytes of Payload;  UB12(Pin) = Value of Upper 12 th 1 Byte of Payload;  if \(\textit{UB}(\textit{Pin})==F\) (Gcc)&&\(\textit{UB12}(\textit{Pin})==S\) (Gcc) then  L(Pin) = Payload's Lengths;  ML(Pin) = Value of Message Length Header of Payload;  MLc(Pin) = L(Pin) - 12;  RED(P) = 0; if \(L(\textit{Pin})<280\)&&\(\textit{LB}(\textit{Pin})>200\)&&\(\textit{ML}(\textit{Pin})==\textit{MLc}\) (Pin) then  RED(P) = 1; else  end if  else  end if  end if  return RED(P) and N(P);
```  
**Algorithm 2 Resource exhaustion traffic detection algorithm.**