Abstract: A method, system and apparatus for outlier exposure based anomaly detection for detecting anomalies in network traffic are disclosed. According to one or more embodiments, a central node (17) is configured to train an Outlier Exposure (OE)-based autoencoder using unlabeled network data and labeled network attack data where the OE-based autoencoder is trained to reconstruct input data with an objective that is configured to minimize a reconstruction error on unlabeled network data and to maximize the reconstruction error on labeled network attack data, use the trained OE-based autoencoder to determine a reconstruction error on network traffic, and compare the determined reconstruction error to a threshold to determine if local network traffic is an anomaly.

Abstract: A method, system and apparatus are disclosed. According to one or more embodiments, a detection node includes processing circuitry that is configured to determine a forecast sequence using a first prediction model, where the forecast sequence is determined based at least in part on an input sequence, and determine a reconstructed forecast sequence using a second prediction model, where the reconstructed forecast sequence is determined based at least in part on the determined forecast sequence. The processing circuitry is also configured to determine a reconstruction error between the determined reconstructed forecast sequence and the determined forecast sequence and determine a signaling behavior for anomaly detection based at least in part on the determined reconstruction error and a predetermined threshold.

Abstract: The solutions and methods are directed to spoofing detection approaches and post-spoofing attack prevention schemes. When a first network node such as a Mobility Management Entity, MME, receives a request from an attacker, the first network node sends a modified copy of the request to a second network node such as Home Subscriber Server, HSS, for verification of the request. When the first network node receives a response from the second node and finds that the request is a spoofed request, the first network may disregard the request. This example of the spoofing detection approaches may help the second network node to avoid disruptions of services such as Denial-of-Service, DoS, attacks that could have been caused by multiple Update Location Requests, ULRs, sent by multiple User Equipment, UE, after the spoofing attempted by the attacker becomes successful.

Abstract: Methods, systems, and apparatuses are disclosed. A network node configured for performing network routing associated with a plurality of wireless devices, WDs, in a communication system is described. The network node includes processing circuit configured to collect, from a control plane, a plurality of graph states associated with a plurality of graphs. Each graph of the plurality of graphs has at least one graph node associated with one WD of the plurality of WDs. At least one action is determined, using self-learning, to update at least one route in at least one graph of the plurality of graphs based on the collected plurality of graphs states. The at least one action is transmitted to a controller for instructing at least one WD to update at least one network route based on the at least one action.