5GC PFCP Intrusion Detection Dataset

The advancements in the field of telecommunications have resulted in an increasing demand for robust, high-speed, and secure connections between User Equipment (UE) instances and the Data Network (DN). The implementation of the newly defined 3rd Generation Partnership Project 3GPP (3GPP) network architecture in the 5G Core (5GC) represents a significant leap towards fulfilling these demands. This architecture promises faster connectivity, low latency, higher data transfer rates, and improved network reliability. 5GC has been designed to support a wide range of critical Next Generation Internet of Things (NG-IoT) and industrial use cases that require reliable end-to-end communication services. However, this evolution raises severe security issues. In the context of the SANCUS1 project, a set of cyberattacks were investigated and emulated by K3Y against the Packet Forwarding Control Protocol (PFCP) between the Session Management Function (SMF) and the User Plane Function (UPF). Based on these attacks, an intrusion detection dataset was generated: 5GC PFCP Intrusion Detection Dataset that can support the development of Artificial Intelligence (AI)-powered Intrusion Detection Systems (IDS) that use Machine Learning (ML) and Deep Learning (DL) techniques. The goal of this report is to describe this dataset.

电信领域的技术进步使得用户设备（User Equipment，UE）与数据网络（Data Network，DN）之间对健壮、高速且安全的连接需求与日俱增。第三代合作伙伴计划（3rd Generation Partnership Project，3GPP）在5G核心网（5G Core，5GC）中定义的新型网络架构的落地，是满足此类需求的重要突破。该架构可实现更快的连接速度、更低的网络延迟、更高的数据传输速率，并大幅提升网络可靠性。5GC被设计为支持各类关键的下一代物联网（Next Generation Internet of Things，NG-IoT）与工业应用场景，此类场景均需可靠的端到端通信服务。然而，这一技术演进也带来了严峻的安全挑战。在SANCUS1项目的背景下，K3Y团队针对会话管理功能（Session Management Function，SMF）与用户面功能（User Plane Function，UPF）之间的数据包转发控制协议（Packet Forwarding Control Protocol，PFCP）开展了一系列网络攻击的研究与仿真。基于上述攻击场景，研究者生成了一款入侵检测数据集：5GC PFCP入侵检测数据集，该数据集可用于支撑基于人工智能（Artificial Intelligence，AI）、机器学习（Machine Learning，ML）及深度学习（Deep Learning，DL）技术构建的AI驱动型入侵检测系统（Intrusion Detection Systems，IDS）的开发。本报告的核心目标正是对该数据集进行详细阐述。

搜集汇总

背景与挑战

背景概述

该数据集是一个专注于5G核心网PFCP协议入侵检测的标准化数据集，发布于2023年，用于支持基于机器学习和深度学习的AI驱动入侵检测系统开发。它包含模拟的四种PFCP相关DoS攻击数据（会话建立、删除和两种修改攻击），每种攻击持续4小时，数据格式包括CSV、PCAP等，源自SANCUS项目并由Horizon 2020资助。