An Integrated Zero-Trust and Real-Time Detection Scheme for DDoS Protection in 5G IoT Systems

This study presents a laboratory-scale prototype that integrates a zero-trust-based permission-control mechanism with real-time DDoS traffic detection in a 5G NSA IoT testbed. The proposed system was evaluated under three controlled traffic conditions: normal traffic, TCP SYN flood traffic, and UDP flood traffic. Packet-level data were collected from the experimental testbed and used to train and compare LSTM and SVM classifiers. Under the evaluated conditions, the LSTM model achieved the highest accuracy of 99.56%, outperforming the best SVM result of 93.20%. The selected LSTM detector was further deployed in the edge-computing pipeline and correctly identified the three tested traffic conditions during real-time operation. After malicious traffic was identified, the permission-control mechanism updated the corresponding authorization status, generated an alert, and restricted suspicious communication within the testbed. These results demonstrate the feasibility of linking traffic detection with authorization adjustment in a controlled 5G NSA IoT prototype. The findings should not be interpreted as a general validation against all DDoS variants or large-scale commercial 5G IoT deployments.