Aprendizado de máquina para detecção de ataques Mirai em redes IoT 5G

Abstract

The massification of the Internet of Things (IoT) imposes challenges that legacy mobile networks cannot support. To overcome them, 5G adopts a service-based architecture. However, due to cost and hardware constraints, end devices are frequently vulnerable, making them ideal targets for recruitment into massive botnets, such as the Mirai malware, to orchestrate Distributed Denial of Service (DDoS) attacks. By employing obfuscation and encapsulation (GRE-ETH and GRE-IP), these attacks travel disguised within the operator’s tunnels (GTP-U), bypassing traditional filters. To block such anomalies, this work proposes a proactive Intrusion Detection System (IDS). Inspired by the Network Data Analytics Function (NWDAF), the solution implements an Analytics Logical Function (AnLF) as a decentralized microservice at the Fog Computing layer. Bypassing the cellular encapsulation blind spot, the system evaluates flow-based traffic extracted at the egress interface of the User Plane Function (UPF/N6), processing pure IP traffic free from GTP-U noise. Training was based on the CICIoT2023 dataset, adopting the LightGBM algorithm for its lightness and interpretability. Empirical validation occurred in a 5G testbed (Open5GS and UERANSIM) subjected to a stochastic emulator, calibrated via eXplainable Artificial Intelligence (SHAP) and Wasserstein Distance (W1) minimization. In an offline environment, the model achieved a Macro F1-Score of 0.97. Under the dynamic conditions of the testbed, the system maintained an 88.00% Accuracy and a perfect Precision (1.00) for legitimate traffic, ensuring 100% containment of encapsulated threats (0.0% evasion). Furthermore, Unsupervised Domain Adaptation validated the cross-generalization in novel topologies (Bot-IoT dataset). The architecture advances the state of the art by proving that post-tunnel statistical extraction resolves the severe predictive degradation caused by cellular encapsulation (GTP-U)—a limitation reported in the literature for detections at the core ingress (N3 interface). This approach, combined with ensemble models, eliminates the cost of Deep Packet Inspection (DPI), enabling threat containment in microseconds (16.50 µs) and protecting next-generation mobile networks.