Abstract: A method, system and apparatus are disclosed. According to one or more embodiments, a detection node includes processing circuitry that is configured to determine a forecast sequence using a first prediction model, where the forecast sequence is determined based at least in part on an input sequence, and determine a reconstructed forecast sequence using a second prediction model, where the reconstructed forecast sequence is determined based at least in part on the determined forecast sequence. The processing circuitry is also configured to determine a reconstruction error between the determined reconstructed forecast sequence and the determined forecast sequence and determine a signaling behavior for anomaly detection based at least in part on the determined reconstruction error and a predetermined threshold.

Abstract: Systems and methods for selective User Plane protection in a 5G virtual RAN are provided. A method performed by a gNB Central Unit (gNB-CU) for communicating with a gNB-Distributed Unit (gNB-DU) includes determining whether to selectively encrypt a PDU to be sent to the gNB-DU if the PDU is not otherwise encrypted. In response to determining to selectively encrypt, the method includes encrypting the PDU to be sent to the gNB-DU. In response to determining to not selectively encrypt, the method includes passing the PDU to be sent to the gNB-DU. In this way, additional security is provided while performance impact is minimized. In some embodiments, this provides a lower overhead on the gNB-CU-UP side compared to applying a generic protection of all PDUs. Additionally, the latency overhead is limited since a secure session establishment and handshake is confined to the gNB-CU-UP-SEG domain instead of gNB-CU-UP to gNB-DU.

Abstract: Methods, systems, and apparatuses are disclosed. A network node configured for performing network routing associated with a plurality of wireless devices, WDs, in a communication system is described. The network node includes processing circuit configured to collect, from a control plane, a plurality of graph states associated with a plurality of graphs. Each graph of the plurality of graphs has at least one graph node associated with one WD of the plurality of WDs. At least one action is determined, using self-learning, to update at least one route in at least one graph of the plurality of graphs based on the collected plurality of graphs states. The at least one action is transmitted to a controller for instructing at least one WD to update at least one network route based on the at least one action.

Abstract: A method for steering an original packet transmitted by a UE. The method includes receiving a first packet, wherein the first packet encapsulates the original packet. The method also includes extracting networking information (e.g., IP source, IP destination, tunnel identifier) from the first packet. The method also includes generating an SFC header (e.g., an NSH header), wherein the SFC header comprises: i) an SPI that identifies a service path and ii) metadata, wherein the metadata comprises the networking information extracted from the first packet. The method also includes generating a second packet comprising the SFC header and the original packet. The method also includes providing the second packet to an SFF that is configured to select a service path based on the SPI included in the SFC header of the second packet and forward the second packet based on the selected service path.

Abstract: Systems and methods for maintaining privacy of security protocol parameters are provided. A node receives an encrypted packet and determines if the Security Parameters Index (SPI) value has been updated. The node can modify its stored SPI value(s) accordingly and process the encrypted packet.

Abstract: Apparatuses and methods are disclosed for enabling signalling storm mitigation in Internet Protocol (IP) Security (IPsec)-secured virtual Radio Access Network (vRAN). In one embodiment a method in a first network node includes receiving a trigger to establish an IPsec session with a second network node, the IPsec session being associated with a user equipment (UE); responsive to the trigger to establish the IPsec session associated with the UE, derive a unique identifier for the UE; generate a Security Parameter Index (SPI) value based at least in part on the unique identifier derived for the UE, the SPI value being unique to the IPsec session; and communicate an indication of the SPI value to the second network node.

Abstract: A method, system and apparatus are disclosed. According to one or more embodiments, a detection node includes processing circuitry that is configured to determine a forecast sequence using a first prediction model, where the forecast sequence is determined based at least in part on an input sequence, and determine a reconstructed forecast sequence using a second prediction model, where the reconstructed forecast sequence is determined based at least in part on the determined forecast sequence. The processing circuitry is also configured to determine a reconstruction error between the determined reconstructed forecast sequence and the determined forecast sequence and determine a signaling behavior for anomaly detection based at least in part on the determined reconstruction error and a predetermined threshold.

Abstract: The solutions and methods are directed to spoofing detection approaches and post-spoofing attack prevention schemes. When a first network node such as a Mobility Management Entity, MME, receives a request from an attacker, the first network node sends a modified copy of the request to a second network node such as Home Subscriber Server, HSS, for verification of the request. When the first network node receives a response from the second node and finds that the request is a spoofed request, the first network may disregard the request. This example of the spoofing detection approaches may help the second network node to avoid disruptions of services such as Denial-of-Service, DoS, attacks that could have been caused by multiple Update Location Requests, ULRs, sent by multiple User Equipment, UE, after the spoofing attempted by the attacker becomes successful.

Abstract: Methods, systems, and apparatuses are disclosed. A network node configured for performing network routing associated with a plurality of wireless devices, WDs, in a communication system is described. The network node includes processing circuit configured to collect, from a control plane, a plurality of graph states associated with a plurality of graphs. Each graph of the plurality of graphs has at least one graph node associated with one WD of the plurality of WDs. At least one action is determined, using self-learning, to update at least one route in at least one graph of the plurality of graphs based on the collected plurality of graphs states. The at least one action is transmitted to a controller for instructing at least one WD to update at least one network route based on the at least one action.

Abstract: Systems and methods for selective User Plane protection in a 5G virtual RAN are provided. A method performed by a gNB Central Unit (gNB-CU) for communicating with a gNB-Distributed Unit (gNB-DU) includes determining whether to selectively encrypt a PDU to be sent to the gNB-DU if the PDU is not otherwise encrypted. In response to determining to selectively encrypt, the method includes encrypting the PDU to be sent to the gNB-DU. In response to determining to not selectively encrypt, the method includes passing the PDU to be sent to the gNB-DU. In this way, additional security is provided while performance impact is minimized. In some embodiments, this provides a lower overhead on the gNB-CU-UP side compared to applying a generic protection of all PDUs. Additionally, the latency overhead is limited since a secure session establishment and handshake is confined to the gNB-CU-UP-SEG domain instead of gNB-CU-UP to gNB-DU.

Abstract: Systems and methods for maintaining privacy of security protocol parameters are provided. A node receives an encrypted packet and determines if the Security Parameters Index (SPI) value has been updated. The node can modify its stored SPI value(s) accordingly and process the encrypted packet.

Abstract: Apparatuses and methods are disclosed for enabling signalling storm mitigation in Internet Protocol (IP) Security (IPsec)-secured virtual Radio Access Network (vRAN). In one embodiment a method in a first network node includes receiving a trigger to establish an IPsec session with a second network node, the IPsec session being associated with a user equipment (UE); responsive to the trigger to establish the IPsec session associated with the UE, derive a unique identifier for the UE; generate a Security Parameter Index (SPI) value based at least in part on the unique identifier derived for the UE, the SPI value being unique to the IPsec session; and communicate an indication of the SPI value to the second network node.

Abstract: A technique for monitoring activity in a content delivery network is disclosed.

Abstract: A technique for monitoring activity in a content delivery network is disclosed.