5 G networks, essential for applications like smart cities and factories, must ensure high reliability, availability, and security. However, the safety of 5 G remains a matter of concern. Despite its enhanced security mechanisms compared to previous generations, our study identifies two novel denial-of-service (DoS) signaling attack types that can disrupt the 5 G control plane (CP), exposing weaknesses in its current security design. Traditional switches cannot prevent such attacks because they are unable to extract attacking user equipment (UE) information from encapsulated nonaccess stratum (NAS) data. While ensuring the availability of the 5 G CP is essential to protect 5 G services, this issue has emerged as a pressing challenge. To address this challenge, we propose a novel P4-based user equipment fingerprinting (P4USE) method to mitigate 5 G CP DoS signaling attacks. Leveraging P4's programmable packet processing capability, P4USE can parse encapsulated NAS information at line rate, identify UE fingerprints, and drop anomalous NAS messages originating from attackers. Experimental evaluations in Open5GS confirm both the existence of the identified vulnerabilities and the effectiveness of P4USE in mitigating them. Overall, our work reveals two novel vulnerabilities and presents a defense solution to enhance the availability and security of the 5 G CP.

Cybercriminals controlling multiple accounts to conduct malicious activities are a threat to the security of online services. These accounts form malicious communities that are difficult to detect using conventional methods with single-factor identity, such as browser fingerprint or internet protocol (IP) address. Single-factor identity is prone to noise and uncertainty and does not capture dynamic relationships between accounts. To solve the problems of insufficient single-factor identity and uncertainty binding between accounts and identity, we propose Ai-Urg, a novel account identity-based uncertain graph with multifactor identity modeling for online service fraud detection. To find account groups, we embed account representation that preserves the uncertain graph’s possible world semantics and use the domain knowledge that accounts of family members also from small communities to filter these benign groups and detect malicious communities. The ablation study demonstrates how each component contributes to the effectiveness of Ai-Urg. The comparison results on two datasets show that Ai-Urg outperforms the alternatives with a higher F1-score (58.0%) and precision (46.0%) on a real-world online bank dataset and with a higher F1-score (36.5%) and precision (96.9%) on a large-scale single-sign-on online service dataset. The experimental results can provide valuable insights into online service fraud detection.

As network environment becomes more dynamic and complex, deploying distributed firewalls with access control lists in software-defined network can protect internal services and hosts from network attacks and insider attacks. With ever-changing types and sources of attacks, firewall policies need frequent updates. However, most existing integer linear programming-based solutions require recomputing the rule placement to optimize certain performance criterion. This leads to the cost of high computation overhead. To deal with the challenges of dynamic updates of firewall rules and rule placement, we propose a resource constraint splitting algorithm to compute only the rules related to the updated policies and preserve the others. The key idea is to separate the decision variables into disjoint subproblems and to only solve the associated part. Simulation results demonstrate that this approach shows significantly less computation time while maintain the optimized rule placement for network performance.