# A Distributed Trustable Framework for AI-Aided Anomaly Detection +
## 4 Performance Evaluation
### Core Network Attacks  
The first use case focuses on the core network, and more specifically, on the packet forwarding control protocol (PFCP) that is used for communication between control plane and user plane functions. To train and evaluate ML models, we used the 5G core PFCP Intrusion Detection dataset that was generated in an open-source 5G testbed [35]. In this setup, an SMF instance is assumed to be networked in parallel to the original network function, acting as the attacker's entry point to the virtualized infrastructure and targeting the N4 interface between the SMF and the user plane function (UPF). The hijacked SMF executes various cyberattacks against the UPF. In order to create this dataset, the network traffic data of each entity/device was captured through Tshark for each network function and radio element. From this dataset, we obtained 5890 samples, of which 2862 are labeled as \"normal\" and 3028 are labeled as \"attack\", corresponding to a class ratio of 51.5-48.5%. Attacks are divided into (1) PFCP Session Modification attacks (1033 samples), (2) PFCP Session Establishment attacks (960 samples), and (3) PFCP Session Deletion DoS attacks (1035 samples). For optimization and dimensionality reduction purposes, we initially conducted a feature importance test based on the analysis of variance (ANOVA) [37]. As a feature selection method, ANOVA identifies which of the input features are highly dependent on the response variable by testing whether the means of the features differ or not. The resulting ANOVA F-score is a statistical measure that ranks the features based on the ratio between variances. In greater detail, the ANOVA F-score is defined as follows:  
Figure 3: The FL-based DTE architecture. \[F=\frac{\text{Mean Square Between Groups (MSB)}}{\text{Mean Square Within Groups (MSW)}}. \tag{1}\]  
MSB is calculated as follows:  
\[\text{MSB}=\frac{\text{SSB}}{df_{B}}, \tag{2}\]  
with  
\[\text{SSB}=\sum_{i=1}^{k}n_{i}(\bar{X}_{i}-\bar{X})^{2}, \tag{3}\]  
where \(n_{i}\) denotes the sample size in group \(i\), \(\bar{X}_{i}\) is the mean of group \(i\), and \(\bar{X}\) is the overall mean. Moreover, \(df_{B}\) denotes the degrees of freedom between groups, calculated as \(df_{B}=k-1\), where \(k\) is the number of groups. Then, MSW is calculated as follows:  
\[\text{MSW}=\frac{\text{SSW}}{df_{W}}, \tag{4}\]  
with  
\[\text{SSW}=\sum_{i=1}^{k}\sum_{j=1}^{n_{i}}(X_{ij}-\bar{X}_{i})^{2}, \tag{5}\]  
where \(X_{ij}\) denotes the observation in group \(i\), and \(\bar{X}_{i}\) is the mean of group \(i\). Also, \(df_{W}\) denotes the degrees of freedom within groups, calculated as \(df_{W}=N-k\), where \(N\) is the total number of observations. Substituting the expressions for MSB and MSW, the ANOVA F-score can be calculated as follows:  
\[F=\frac{\frac{\text{SSB}}{\text{SSW}}}{\frac{\text{$F-1$}}{\text{$\text{$\text {$\text{$\text{$\text{$\text{$\text{$\text{$\text{$\text{$ $\text{$\text{$\$}}$}$}}$}}}$}}}}}. \tag{6}\]  
The features corresponding to high F-scores are considered more significant than those with low F-scores. Among the dataset features, 6 (out of 10) features with the highest ANOVA F-score were selected. Also, note that the rest of the features showed decreased importance relative to the first six F-scores. Figure 4 shows ANOVA F-score results for the 10 features, which are also listed and defined below, in ascending F-score order:  
* Feature 1: Number of PFCP session modification request messages. * Feature 2: Number of PFCP session modification response messages. * Feature 3: Number of PFCP session establishment response messages. * Feature 4: Number of PFCP session establishment request messages. * Feature 5: Number of PFCP heartbeat request messages. * Feature 6: Number of PFCP heartbeat response messages. * Feature 7: Number of forwarding packets. * Feature 8: Number of backward packets. * Feature 9: Number of PFCP session deletion response messages. * Feature 10: Duration of an active flow.