An Integrated Zero-Trust and Real-Time Detection Scheme for DDoS Protection in 5G IoT Systems.

Area of Science:

• Cybersecurity
• Telecommunications Engineering
• Machine Learning

Background:

• The proliferation of Internet of Things (IoT) devices in 5G networks presents significant security challenges, particularly Distributed Denial of Service (DDoS) attacks.
• Existing security mechanisms may not be sufficient for the dynamic and high-volume traffic characteristic of 5G environments.

Purpose of the Study:

• To develop and evaluate a laboratory-scale prototype integrating real-time DDoS traffic detection with a zero-trust permission-control mechanism.
• To assess the effectiveness of machine learning classifiers, specifically LSTM and SVM, for identifying DDoS traffic in a 5G NSA IoT testbed.

Main Methods:

• Implementation of a 5G NSA IoT testbed incorporating a zero-trust permission-control system.
• Collection and analysis of packet-level data under normal, TCP SYN flood, and UDP flood traffic conditions.
• Training and comparison of Long Short-Term Memory (LSTM) and Support Vector Machine (SVM) classifiers for DDoS detection.

Main Results:

• The LSTM model achieved a highest accuracy of 99.56%, significantly outperforming the SVM model's best accuracy of 93.20%.
• The deployed LSTM detector successfully identified all three tested traffic conditions in real-time within the edge-computing pipeline.
• The permission-control mechanism effectively updated authorization, generated alerts, and restricted suspicious traffic upon detection.

Conclusions:

• The study validates the feasibility of integrating real-time DDoS detection with dynamic authorization adjustments in a 5G NSA IoT prototype.
• The findings highlight the potential of LSTM models for robust DDoS traffic identification in 5G IoT environments.
• Results are specific to the tested conditions and prototype, not a general validation for all DDoS variants or large-scale deployments.