Massive machine-type communications (mMTCs) network slices in 5G aim to connect a massive number of MTC devices, opening the door for a widened attack surface. Network slices are well isolated, resulting in a low impact on other running slices when attackers control IoT devices belonging to an mMTC network slice (i.e., in-slice attack). However, the impact of the in-slice attacks on the shared infrastructure components with other slices, such as the 5G core network (CN), can be harmful, considering the massive number that can be part of mMTC slice. In this article, we propose a zero-touch security management solution that uses machine learning (ML) to detect and mitigate in-slice attacks on 5G CN components, focusing on Distributed Denial-of-Service (DDoS) attacks. To this aim, we propose: 1) a novel closed-control loop that assists the 5G CN in detecting and mitigating attacks; 2) an ML algorithm that predicts the upper bound of expected MTC devices Attach Requests during a time interval (or an event); 3) a detection algorithm that analyzes an event and uses the ML output to compute a probability that a specific device has participated to an attack; 4) a mitigation algorithm that disconnects and blocks MTC devices suspected to be part of an attack; and (5) a proof-of-concept implementation on top of a 5G facility.

The zero Touch Management (ZSM) concept in 5G and Beyond networks (B5G) aims to automate the management and orchestration of running network slices. This requires heavy usage of advanced deep learning techniques in a closed-loop way to auto-build the suitable decisions, enabling to meet network slices’ requirements. In this context, Federated Learning (FL) is playing a vital role in training deep learning models in a collaborative way among thousands of network slice participants while ensuring their privacy and hence network slice isolation. Specifically, running network slices may share only their model parameters with a central entity, e.g., Inter Domain Slice Manager, to aggregate them and build a global model. Thus, the central entity does not directly access the training data. However, FL is vulnerable to poisoning attacks, where an insider participant may upload poisoning updates to the central entity so that it can cause a construction failure of the global model and thus affect its global performance. Therefore, it is crucial to design security means to detect and mitigate such threats. In this paper, we design a novel framework to automatically detect malicious participants in the FL process. In particular, our framework first uses a deep reinforcement algorithm to dynamically select a network slice as a trusted participant, based mainly on its reputation. The selected participant will then be in charge of identifying poisoning model updates by leveraging unsupervised machine learning. We demonstrate the feasibility of our framework on top of a real dataset that we generate using the 5G OpenAirInterface (OAI) platform. Evaluation results show the efficiency of our framework in dealing with poisoning attacks even with the presence of several malicious participants.

The emergent Zero touch Service and Management (ZSM) paradigm aims to automate the orchestration and management of running network slices, in Beyond 5G networks (B5G), with an unprecedented level of scalability. To achieve this vision, ZSM calls for a large usage of advanced deep learning algorithms, in order to dynamically build efficient decisions. In this context, Federated deep Learning (FL) proved their efficiency in not only building collaborative deep learning models, among several network slices, but also ensuring the privacy and isolation of such network slices. Indeed, FL-based solutions give “machine-centric” decisions about running network slices and their performance, which will be then executed/applied by managers, i.e., slice manager staff/module. However, FL-enabled solutions do not provide any details about why and how such decisions were made, and thus such decisions cannot be properly trusted/understood by slice managers. To alleviate this issue, we leverage eXplainable Artificial Intelligence (XAI) paradigm that aims to improve the transparency of black-box FL decision-making process. In particular, XAI helps to explain the FL-based decisions to make them interpretable/trustable by network slices managers. In this paper, we design a novel XAI-powered framework to explain FL-based decisions. We first build a deep learning model in federated way, to predict key performance indicators (KPI) of network slices. Our FL-based KPI prediction is useful for the configuration and the management of network slice lifecycle, especially for the Service Level Agreement (SLA) violation and the network slice re-configuration. Then, we develop several XAI models on the top of our FL-based model, such as SHapley Additive exPlanations (SHAP), Local Interpretable Model-agnostic Explanations (LIME), RuleFit, and Partial Dependence Plot (PDP), to enhance the level of trust, credibility (of the local data/model), transparency, and explanation of the FL-based decisions, while adhering the data privacy, to different B5G network stakeholders, such as slice managers. Experiments results show the efficiency of our XAI-powered framework, to explain FL-based decisions related to latency KPI predictions.

It is well established that 5G will impact not only the end-users by allowing several new services, but also the vertical industry and network operators business. 5G will open the business market to new stakeholders with the introduction of Network Slicing, namely the vertical or tenant, the network slice provider, and the infrastructure provider. The Network Slice provider sells end-to-end network slices (virtual end-to- end mobile network) to the vertical while leasing virtual and physical resources from Infrastructure Providers to enforce these end-to-end network slices. Accordingly, there is a need to establish Service Level Agreement (SLA) among these actors to ensure: (1) that the service is well-delivered to the vertical and (2) the infrastructure providers are respecting their involvement with the network slice provider. To fill this gap, in this paper, we propose a trust architecture to automatically manage the SLAs and apply penalties and compensations if the SLAs are not respected by one of the involved actors.