Graph-based Anomaly Detection in 5G Core Networks - An Evaluation of Temporal Graph Neural Networks for detecting Multi-Step Attacks in Kubernetes-based 5G Core Networks

Abstract

The increasing adoption of service-based and distributed architectures in 5G Core (5GC) networks has introduced new challenges for traditional intrusion detection systems (IDS), which often struggle to identify sophisticated, multi-stage attacks hidden within large volumes of network traffic. While many preventative measures exist to secure system perimeters, there are still scenarios where a malicious actor could gain access to a network. At the same time, Graph Neural Networks (GNNs) have demonstrated strong capabilities in modeling complex relationships and dependencies in networked graph structured data, making them a promising approach for detecting advanced cyber threats in highly interconnected systems. This thesis investigated the capability of GNN-based intrusion detection to identify multi-step attacks in the 5GC. Due to the lack of publicly available datasets containing such attacks in internal 5GC systems, a new dataset was developed by combining generated benign network traffic with a simulated multi-step attack targeting production components of the 5GC environment. A complete detection framework was designed and evaluated, including data pre processing, feature extraction, graph construction, and a GNN architecture. The model architecture consists of a Memory Module, Graph Convolutional Layers and a Edge-level Classification Head. Different architectures and configurations of the model were trained and tested on the data, with the highest stable scoring model having a median F1 Score of 99.55%, showing that it is possible for a graph-based model to detect attacks in a production-like 5GC test environment using simulated network data and a simulated multi-step attack.