5G networks are increasingly exposed to Distributed Denial of Service (DDoS) attacks launched by mobile botnets exploiting user equipment (UE). Existing studies have treated malware propagation and DDoS impact separately, with no prior simulation work having modeled how Device-to-Device (D2D) malware spreads and translates into network-wide DDoS stress. This paper introduces DDoSimu5G, an extension of Simu5G [33] integrated with the ONE simulator [24], which enables, for the first time, the combined modeling of D2D malware propagation, UE mobility, and botnet-driven traffic loads on 5G infrastructure. The framework is aligned with 3GPP Proximity based Services (ProSe) in the 5G System (5GS) TS 23.304 [1] specifications, supports configurable attack scenarios, and generates diverse datasets, including infection logs, mobility traces, and PCAP traffic. By linking propagation dynamics with DDoS effects, DDoSimu5G provides the research community with a reproducible open-source tool for studying and mitigating emerging D2D-driven threats in 5G networks.

The 5thgeneration of mobile networks introduces a new Network Function (NF) that was not present in previous generations, namely the Network Data Analytics Function (NWDAF). Its primary objective is to provide advanced analytics services to various entities within the network and also towards external application services in the 5G ecosystem. One of the key use cases of NWDAF is mobility trajectory prediction, which aims to accurately support efficient mobility management of User Equipment (UE) in the network by allocating "just in time" necessary network resources. In this paper, we show that there are potential mobility attacks that can compromise the accuracy of these predictions. In a semi-realistic scenario with 10,000 subscribers, we demonstrate that an adversary equipped with the ability to hijack cellular mobile devices and clone them can significantly reduce the prediction accuracy from 75% to 40% using just 100 adversarial UEs. While a defense mechanism largely depends on the attack and the mobility types in a particular area, we prove that a basic KMeans clustering is effective in distinguishing legitimate and adversarial UEs.

False base stations – IMSI catchers, Stingrays – are devices that impersonate legitimate base stations, as a part of malicious activities like unauthorized surveillance or communication sabotage. Detecting them on the network side using 3GPP standardized measurement reports is a promising technique. While applying predetermined detection rules works well when an attacker operates a false base station with an illegitimate Physical Cell Identifiers (PCI), the detection will produce false negatives when a more resourceful attacker operates the false base station with one of the legitimate PCIs obtained by scanning the neighborhood first. In this paper, we show how Machine Learning (ML) can be applied to alleviate such false negatives. We demonstrate our approach by conducting experiments in a simulation setup using the ns-3 LTE module. We propose three robust ML features (COL, DIST, XY) based on Reference Signal Received Power (RSRP) contained in measurement reports and cell locations. We evaluate four ML models (Regression Clustering, Anomaly Detection Forest, Autoencoder, and RCGAN) and show that several of them have a high precision in detection even when the false base station is using a legitimate PCI. In our experiments with a layout of 12 cells, where one cell acts as a moving false cell, between 75-95% of the false positions are detected by the best model at a cost of 0.5% false positives.

With the increased commercialization of deep learning (DL) models, there is also a growing need to protect them from illicit usage. For cost- and ease of deployment reasons it is becoming increasingly common to run DL models on the hardware of third parties. Although there are some hardware mechanisms, such as Trusted Execution Environments (TEE), to protect sensitive data, their availability is still limited and not well suited to resource demanding tasks, like DL models, that benefit from hardware accelerators. In this work, we make model stealing more difficult, presenting a novel way to divide up a DL model, with the main part on normal infrastructure and a small part in a remote TEE, and train it using adversarial techniques. In initial experiments on image classification models for the Fashion MNIST and CIFAR 10 datasets, we observed that this obfuscation protection makes it significantly more difficult for an adversary to leverage the exposed model components.

A large share of the early work on on-line handwriting recognition involved structural and syntactical methods. These approaches were soon abandoned in favor of template matching and statistical methods due to the difficulty in defining reliable rules dealing with the large variability in on-line handwritten characters. However, any method for HWR utilize the structural information implicitly and one could argue that their success depends on how well this is done. This paper presents a novel template matching method, the Frame Deformation Energy (FDE) matching, that utilizes the explicit structure of the samples to model the non-linear global variations by a set of affine transformations through a structural reparameterization. Experiments on a large data set show that for single models the FDE, despite its ad hoc implementation in this paper, outperforms conventionally used template matching schemes such as DTW and Active Shape. 1

Most implementations of single character recognition use standard arclength parameterization of the handwritten samples. A problem with the arclength approach is that points on curves of different samples from one character class may then actually correspond to parts of different structural significance. Many methods such as DTW and HMM have been successful partly because they are less sensitive to parameterizational differences. Given a sufficiently fine decomposition of a character sample into smaller segments, the complex non-linear variations of handwritten data can be viewed as a set of local linear transformations of the segments. In this paper we present a parameterization technique that implicitly defines such a structural decomposition. Experiments reveal that recognition rates for kNN template matching increase for reparameterized samples thus proving that the new parameterization removes redundance in a way that is genuinely beneficial for discrimination purposes. In addition to these quantitative results, visual inspection of the modes of singular value decomposition of reparameterized samples show that the new parameterization reduces the impact of parameterizational differences in shape variations of character samples.

One of the difficulties involved in providing commercially acceptable cursive script recognition solutions has been that the training of most systems have been greatly dependent upon dictionaries. In this paper we present a new technique for dictionary interaction in on-line cursive script recognition. It retrieves all possible paths through a segmentation graph, that correspond to words in a dictionary, in a very efficient way. Furthermore we present new ideas of how to treat secondary strokes in the on-line segmentation graph. The novel system has been tested on large data with very competitive results.