# Cyber5 Gym: An Integrated Framework for 5G Cybersecurity Training
## 2 Background
### 5G Security Threats  
The transition to 5G networks has introduced a wide range of security challenges that extend beyond traditional network threats. Advances in technology that enable higher data rates and connectivity also expose networks to new attack vectors and vulnerabilities [4; 5; 26]. The complexity of 5G networks, from their distributed architecture to the use of ML for network management, introduces security risks that can manifest in various forms [4; 11; 26; 27]. In this complex security landscape of 5G networks, the Radio Resource Control (RRC) and Non-Access Stratum (NAS) Security Mode Command (SMC) messages play critical roles in the security and connection setup between UE and the network. However, these messages can become a vector for attacks if not properly secured [5]. These messages, crucial for secure communication, can be exploited through sophisticated cyber threats like the NAS-5G SMC Replay Attack [10]. This attack exploits the replay of an NAS SMC message, potentially granting unauthorized access and leading to data interception. The NAS-5G SMC emerges as a sophisticated cyberattack within the 5G telecommunication domain. This malicious activity entails the replication and subsequent retransmission of an NAS SMC message previously intercepted [10]. The execution of such an attack leads to the deception of network security protocols, resulting in the misidentification of an unauthorized device as a legitimate entity within the network. This breach in security protocol opens avenues for unauthorized access, significantly heightening the risk of sensitive data interception and compromise. The implications of such a vulnerability are extensive, undermining the fundamental tenets of integrity and confidentiality in communications across the 5G infrastructure. This situation thus underscores the urgency for the development and implementation of robust security measures equipped to detect and thwart such sophisticated cyberattacks. Apart from the NAS-5G SMC Replay Attack, 5G networks face threats like Advanced Persistent Threats (APTs), which use stealthy and continuous hacking processes to gain prolonged access to networks, and Man-in-the-Middle (MitM) attacks [28], exploiting the dynamic network slicing capabilities of 5G. Additionally, the seamless connectivity feature of 5G is vulnerable to Distributed Denial of Service (DDoS) attacks because malicious actors can exploit the enhanced connection and bandwidth attributes of the network infrastructure [4]. In such attacks, compromised devices, often part of a botnet, inundate the network with excessive traffic. This can lead to server overloads, service disruptions, and, in severe cases, complete network shutdowns. The distributed nature of 5G networks amplifies their vulnerability to these attacks, demanding adaptive and robust security measures for detection and mitigation. Furthermore, Denial of Service (DoS) attacks in 5G specifically target the high throughput capabilities of the network, differing from traditional DDoS attacks that primarily aim to overwhelm network capacity [10]. These high-bandwidth attacks lead to significant network congestion, degraded service quality, and in extreme scenarios, total network failure. The challenges posed by such attacks, given the high data capacity, underscores the need for advanced detection and mitigation strategies to maintain network stability and reliability. Persistent Packet Data Unit (PDU) session attacks in the 5G core network, such as the Persistent Session Deletion and Persistent Session Modification attacks, involve a malicious entity exploiting the Packet Forwarding and Control Protocol (PFCP) to compromise end-user connectivity to the Data Network (DN) [26]. These attacks target the communication between the Session Management Function (SMF) and User Plane Function (UPF) on the N4 interface. By manipulating PFCP messages, attackers can disconnect a UE from the DN or modify its session to drop all packet handling rules, maintaining the UE's connection to the 5G RAN and core network.