Abstract: An example method for monitoring a software-defined radio access network (SD-RAN) includes receiving, by a computing device, data indicative of communications between a base station configured to provide radio access and one or more network devices. The method also includes generating, by the computing device and based on the data, a telemetry stream indicative of potential anomalous activity in the SD-RAN. The method further includes providing, by the computing device and based on the telemetry stream, an indication of the potential anomalous activity.

Abstract: An automatic technique for generating signatures for malicious network traffic performs a cluster analysis of known malicious traffic to create a signature in the form of a state machine. The cluster analysis may operate on semantically tagged data collected by connection or session and normalized to eliminate protocol specific features. The signature extractor may generalize the finite-state machine signatures to match network traffic not previously observed.